I don't think that's a reasonable deduction, it seems like the contact form on the vendor's website didn't work. That could possibly be compromised by the attacker.