How is it on Github? We know that it was a third-party integration that compromised. Almost every single third-party integration needs the ability to read source code. The fault here lies on Heroku for storing secrets that allowed access to their main customer database in a source code repo that was accessible to a third-party provider, as well as with the third party provider (whatever it was) for allowing their implementation to be compromised. At that point it's game over—your main database should never be accessible from your source code alone.

It is strange to me that they're certain it was accessed through a third-party Github integration, but they don't know which integration it was specifically. That feels like a failure of logging on Github's part, without any additional information.