The incident came to light after a third-party software provider was compromised, officials said.