> The timing on the last point seems to be entirely coincidental. It may also be multiple parties involved and when we're talking breach + defacement + DDoS, it's clearly not just one attack.

It could also be that the attacker has compromised IA communication channels and timed it for maximum dramatic effect and confusion.