They could have cracked the password hashes, most likely collected NetNTLMv2 hashes, using a generated list of weak passwords using the company name + a possible ruleset with hashcat.

Some audits still do it against all NTLM hashes stored on the AD DC, but it fell a bit out of fashion because most orgs don't feel comfortable giving out that data for a pentest.

NetNTLMv2 and NTLM hashes are also still notoriously easy to run dictionary and combo bruteforce attacks on with GPUs.

You can see the benchmark for an RTX 5090 here: https://gist.github.com/Chick3nman/09bac0775e6393468c2925c1e1363d5c

It can do a whopping 340.1 GH/s for NTLM and 16017.9 MH/s for NetNTLMv2

Compare that to a Linux's default yescrypt which didn't even have official support in hashcat until this year because the hashrate would be a measly 70-200 H/s.