If you are asking if the main attack vector was phishing, they are not clear on that:

According to statements released by Brain Cipher, they have exploited critical weaknesses within Deloitte UK’s cybersecurity infrastructure.