Did you read the report? This hack involved spear phishing multiple employees who also had 2FA turned on. Good practices were in place. This was not some admin panel left open to the internet, that would be negligence.