The hackers got into the city's system when an employee clicked on an email link that allowed them to upload malware.