Currently, it is likely that just your session cookie was stolen, with instance admins being targeted specifically by checking for navAdmin, an HTML element only instance admins had. I do not believe this to affect users across instances, but I have yet to confirm this.
Probably because the hackers used some http request to get the data and didn’t want to wade through thousands of rows of JWT strings.
Probably because the hackers used some http request to get the data and didn’t want to wade through thousands of rows of JWT strings.