Responsible journalism would add "alleged" or "supposed" to the "hacker", because we don't actually know that there was a hacker involved.
"Inside job" seems far more likely to me. We have no proof of either, so we can only speak of possibilities.
Most "hacks" in this world are either social engineering, or inside jobs.
But the easiest thing is to blame an "unnamed hacker".
Probably from Russia!