No exploit and no zero-day. An account existed, it had a guessable password, and nobody had required a second factor on it.