I guess it's possible that the dev firmware could exploit (or highlight) a flaw in the PSN code to allow somebody to cycle through the records, maybe some unused developer-only procedures or something?

Otherwise it could have been anything, from the compromised employee's machine, a server hack, or some other intrusion.

I'm sure we will get quite a bit more detail at some stage, if it is an exploit of the user-side then I'm sure it will be explained in detail by an outsider, anything else and it will probably be a high level explanation.