I don’t think you understand how anonymous sources work. It’s not like they get a phone call from a random pay phone and then publish what that person says as gospel. Gothamist knows who the hacker is and what their credentials are, but they don’t release that info to protect that person’s identity. I have no reason to believe that Gothamist didn’t properly vet their source, so I believe this story.