The Debian Project has posted an investigation report explaining how their machines were compromised.