What I heard was that one of the hackers managed to get access to Twitter's internal Slack, and that hacker was the one posing as having a Twitter employee friend. Don't know if that's true though.