The initial wave of reports makes reference to the compromise of the remote access software vendor; the consequences of which, if true, would be far greater than a single isolated incident.

This follow up story makes no reference to the compromised software vendor.