The API served the request as it would any other. The credential came from a vendor’s environment, and the vendor is the one party nobody has named.
One vendor incident becomes many provider notifications on different dates. Anyone counting breaches sees several small ones.