Despite providing a username, it’s probably more difficult for the Heritage foundation to find them than it was for the hacker(s) to gain entry to the system. Even the announcement was encrypted via telegram.
The article seems to detail exactly what the headline says. ¯(ツ)/¯