I haven't seen anything that confirms or even suggests a compromise of the platform. It looks to me as a handful of accounts brute-forced into using a dictionary attack over an API endpoint that did not enforce rate limiting of login attempts.