From TFA:

Fun fact: Google’s security team managed to penetrate one of the servers being used by the attackers, which was how the full extent of the attack—more than 30 companies—was revealed.

redditor Dax420 says:

This is why I have always loved the “wild wild west” aspect of the internet. When shit happens you don’t simply call the internet police, you do your own detective work and if necessary take action to stop it.