It's possible that they knew they were either losing access (perhaps a vendor update or action was going to break access) or that news was going to spread due to some upcoming legal case. In that case they might try to get as much impact as possible, especially if they were in position to monitor what spooked users tried to switch to or whether they started communicating to previously unseen partners.