On The Deloitte Breach

This breach of Deloitte looks more and more brutal. According to the story, "A breach at Deloitte involved usernames, passwords and personal data on the accountancy’s top blue-chip clients." What's your guess on what the attackers successfully exploited? Weak remote access authentication methods and sloppy role-based access?