FWIW, the traffic coming from China was 4x the volume coming from Canada in that time frame. And Canada is usually our 2nd highest traffic source. The traffic level was almost 1/3rd the US level. It appears that the hack was routed via a Chinese site, and I'm pretty certain that was not the originating site.
Steps have been taken to prevent this in the future.