Maybe.
Maybe not.
Your guess is as good as anyone elses unless you had access.
My guess is inside job or they have bad luck beyond statistical reason.
Multiple attacks over several years, same types of purchases/charges, non existant security, late warnings, email spin,....
If it walks like a...