Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:

- User account with access to the SaaS password manager was compromised.

- User account with access to the SaaS password manager was compromised.

- User account with access to the SaaS password manager was compromised.

- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.

EDIT forgot one:

- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.

They also didn't specify whether this is on-prem or cloud. Big dif why a 'hack' can occur...

Probably LastPass

Last pass. Twice iirc.