I’d put my money on “disgruntled ex-employee”. At the very least, a competent hacker would know how to hide their tracks.
I’m guessing somebody got social engineered. It’s as good as having an insider, and far easier
Or deliberately leave a trail pointing to another, or pointing to yet another. Pointer to a pointer. In computer terms trivial stuff.