The spokesman was incorrect, the October incident was not from NGP VAN. From their press release:
"Josh Uretsky, the former National Data Director for the Sanders campaign confirmed on MSNBC (at 5:47), and also on CNN, regarding the previous incident: 'it wasn’t actually within the VAN VoteBuilder system, it was another system.'" [1][2]