Yes, they must have been a member of the Norwegian Foreningen Svartehattehackere. They are a very strong union.

I assume the break is to have less chance of their activities be discovered and/or connected.

Might be a coincidence. A certain nation-state is currently engaged in all-out war; the intruder might have been summoned to another, more urgent task.