Comment by Erlangen

> Notably, the first scan of this URL on the VirusTotal platform occurred in late September, by a user from Taiwan.

Could this be the attacker? The scan happened before the hack was first exposed on the forum.