The breach at wearable ring maker Ultrahuman stemmed from credentials stolen from a malware-infected employee laptop.