The article posits that they may just have centralized monitoring, not control. Since this didn't affect every location, I would assume it was a shared default password or something