It's the RUSSIAN!. And if its doesn't work than it's got to be CHINA!
Outside this particular case, the most likely HOW breach of this scale to happen is similar to this (extremely common) ;
In the context of cybersecurity, there are only 3 vectors of attack, there are ;
Men in the Middle...