Likewise.

   Suspicious events prompted an immediate investigation and the compromised credentials used by this intruder were then restricted

Does that mean the credentials were gained outside of Linode and used to change the root passwords of the accounts for the purposes of the theft, or were those credentials used as part of an exploit in Linodes systems?