Actually the problem is not which repos he accessed (they can easily determined by looking at their logs), the problem is if/how_many other repos have been accessed by blackhats who knew this exploit before, and what kind of commit they've done to all these projects.