To clarify:<p>The Sanders campaign had in October reported an unrelated software issue in a non-VAN system.<p>They did not report THIS issue to the DNC or NGP VAN, but claim they were gathering information about the breach for the purposes of reporting.  Based on my reading of the OP, the breach was discovered by NGP VAN employees.