I joined this platform to reply to you and now my first post has a typo :-( instead, not indead.

Hi Catalin, It is down to the evidence we collect during the DFIR engagement. We may know the credentials are compromised, but we might not be able to identify how this occured. If we find evidence it was from phishing or bruteforce we would then categorize them as that indead.