The most likely cause is the introduction of a compromised third-party component into the payment system that contained malicious code designed to perform unauthorized transactions. This reflects a supply chain attack where a trusted component is exploited to gain access to an organization's systems. The other reasons listed might also cause security issues, but they either do not directly relate to the recent change in the system (existing unpatched vulnerabilities or end-of-life software) or are less likely based on the specifics provided in the scenario (lack of multifactor authentication).