Its private operator says one of its modules, not the whole app, was compromised, based on an independent forensic analysis.