Reposting my response from below, but the October incident was not with NGP VAN and was actually another vendor - not sure who though but I'd be interested in hearing theories.
From their press release:
"Josh Uretsky, the former National Data Director for the Sanders campaign confirmed on MSNBC (at 5:47), and also on CNN, regarding the previous incident: 'it wasn’t actually within the VAN VoteBuilder system, it was another system.'" [1][2]