I agree -- the language is just so vague, but getting the client list and not accessing the server seems to be either obfuscation or a cloud service was also hacked.