It wasn't even a sophisticated phishing attack. If you believe the reporting, the whole thing would have been avoided were it not for a typo.