While the compromise of a second customer was just an initial step in its wider hacking campaign, it shows that the rogue agent roamed further afield than was previously known.