Security experts remain puzzled how hackers orchestrated their compromise of a Virginia state health care website.