To be clear, the CRA itself doesn't appear to have been hacked.
From the article, it was a "credential stuffing" attack where they get in using a password that the victim has reused on another site. This is why one should NEVER reuse the same password on multiple sites. That other site was hacked, the passwords were stolen, and then they tried those same username/password combos on the CRA or GCKey(bank) site logins.
Use a password manager. Lastpass and KeePass are just two great examples... of course use a strong, preferably random, password as the master password on a password manager.