nobody knows the attackers and there is really no reason to assume it is CRIS.
many in the industry have been attacked this year, ironically, CRIS also.
Ive seen many notices at the books I play at giving back up addresses and making sure customers are aware of them