The actual hack took place over a month ago and the bad actor has been on the move.