Attackers accessed it via third-party services provider, says management group