Not surprised. When or if more information becomes available I’ll bet at least $5 the subcontractor used a poorly configured cloud hosting provider.