The norforge report sounds like they were targeting magento (e-commerce) sites to steal some $. Darn, was hoping they were trying to swipe DRM keys or something.
Magento is ridiculously complex, open-source, and often self-maintained. It's probably fairly easy to exploit, especially for outdated deployments. And (vs. Wordpress) has payment info to intercept.
https://github.com/search?q=cairn+in%3Aname+created%3A%3E202...
One of those companies that clearly deserved it.