Here it states that the hoster used is hetzner https://lemm.ee/post/45660045. That being said Hetzner is a german company, so I would expect it to be in the eu.

How can such thing happen? Was an account hacked that had the permissions?

That is super cool. Can we might simulate it in a virtual environment? If so, would that be the first matrix like virtual world?