Responsible journalism would add "alleged" or "supposed" to the "hacker", because we don't actually know that there was a hacker involved.
"Inside job" seems far more likely to me. We have no proof of either, so we can only speak of possibilities. Nobody has any proof of anything.