It is of note that they're claiming a social engineering attack on an internal employee; not a wide spread social engineering attack on each individual account.