The agency determined that perpetrators gained privileged access to the IT network by compromising a front-end workstation, and obtained login credentials to assess the database, while hiding their digital footprints.