The theft occurred after the hackers allegedly compromised an employee of C&M, a software service provider, by buying the employee’s login credentials.