I'm curious if they even know right now or if the code was being injected dynamically somehow. The post is sparse on the details.