MOVEit transfer vulnerability exploited by Cl0p

I'm curious how they grabbed the data if MOVEit by default encrypts not only all data transfer but the data itself. Was the data grabbed by lateral movement or default encryption was disabled? Or keys stolen with lateralmente movement] I would appreciate more information.

cl0p cybersecurity data data transfer default disabled encryption exploited information keys lateral movement moveit moveit transfer stolen transfer vulnerability vulnerability exploited