The SIPRnet shutdown is because of the compromised SolarWinds Orion thing. Which is essentially a network monitoring and management system, by it's very definition deeply engrained into the network infrastructure that it manages and monitors. And this Orion thing was mighty popular with both big gov and transnational corps.
$10 say that the scale of this thing is so BIG, the Orion "hack" was a clown op - Probably the central building block of the infamous HAMR access platform. And someone at the C_A "lost" one of the command & control access keys while the Chinese then "found" exactly that key. Who knows to whom else the Chinese gave access.
Literally everything of value has been compromised, and then shit got out of hand really bad.