Our investigation has revealed that the attacker used a security vulnerability in Movable Type to upload a tool that allowed them to deface the site, and to take the contents of the mt_author table (which contains names, email addresses, and hashed passwords).