This was a big time process failure -- almost every company I worked for you have to authenticate with SSO and MFA and never have static credentials for important services like Github, Google cloud, etc. They don't seem to have least-privilege in place and if they did are not consistent about applying the policy to everyone.

I wouldn't be surprised if the guys they compromised were high-level staff engineers with the keys to the kingdom so to speak so they found a loophole. Security is hard because the attack only needs one chance to get it right -- and defense needs to get it right every single time.