Investigators found that someone used a compromised login to access the site and copy files at various times between May 22 and Sept. 18.