Frank Bi has got hold of notes from the meeting between the Muir Russell inquiry and CRU's IT personnel, and has some comments re the nature of the CRU Hack.
For me, the most interesting bit of information from the notes is:
JCF – hackers were in from Oct (we believe they offered info to BBC in early October) and again mid Nov. Not sure if they were continuously hacking in the meantime.
The BBC writer referenced above is almost certainly Paul Hudson; it seems likely that, after Hudson's piece --"Whatever Happened To Global Warming"-- generated a series of negative e-mail comments from CRU staff, the hackers shopped these emails to Hudson in hopes that he might take offense and write another story along the same lines as his original. When this did not occur, the hackers gathered further material and looked around for a place to dump it.
So it looks as though their plans evolved significantly over the course of the ongoing crime.