GitHub was not at fault. Someone gained access to an account using a disclosed password scheme.

Also, the Microsoft acquisition of GitHub hasn't happened - they have only agreed to acquire GitHub.