Stolen credentials were used in the South Carolina data breach, according to a report prepared by a forensics team investigating the incident.