From what I scanned, there was no reason given on why they only attacked cloud based providers.

My guess is that these are paid ones and thus have a 'market share', easier to attack etc.

If you attack a 'keepass' password the attack vector is more crypto / memory based as far as my limited knowledge goes and not some funky inbetween attack.

Also, if you attack a cloud base provides, you will most likely have multiple victims per breach / exploit, whilst offline are targeted and thus not so interesting in most cases unless we're talking about a person of interest