I guess if you have access to a build server that you might spy out some access credentials to other venues. Not impossible at least or perhaps some sort of service account was compromised that had access to both. Doesn't mean there was an immediate proximity of these system, although that might also be possible.