Ah, this makes most sense to me, the details of the compromise must have already been published,

"The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far."

https://xcancel.com/i/status/2056949168208552080