I messaged CEO + CTO, and posted on the forum, this attack seems very targeted, only started after everyone is offline, fake website was well done.
I'm waiting for confirmation that nothing else was breached in fly.