A Heritage spokesperson told CyberScoop after publication that the organization was not “hacked.” Instead, the spokesperson said “an organized group stumbled upon a two-year-old archive of The Daily Signal website that was available on a public-facing website owned by a contractor. The information obtained was limited to usernames, names, email addresses, and incomplete password information of both Heritage and non-Heritage contributors, as well as article comments and the IP address of the commentor.”

At least they're admitting to being incompetent...