The title on HN is clickbait, the article mentions Gitlab users storing their own Gitlab password/tokens insecurely. It doesn't look like "Gitlab was compromised" to me.
The original title is "Critical security announcement: Suspicious git activity detected".
The original title is "Critical security announcement: Suspicious git activity detected".