The attackers have mined in parallel and in the moment of the reorg they must have had bigger than 50% hash power otherwise they can't do the reorg.

"Selfish/mining: Strategic withholding (selfish mining) lets a minority p exploit timing to increase relative revenue and cause short reorgs, but it does not let them deterministically rewrite many confirmations unless p is near 50% and luck favors them."

"What happened technically: An 18-block "reorg" (reorganization) hit the Monero network - meaning that 18 blocks the entire network believed to be valid and permanent were suddenly discarded and replaced by an alternative version of history. To put this in perspective, reorganizations of more than 2-3 blocks are extremely rare in established blockchain networks.

The financial outcome: 55 confirmed double spends (the same money spent twice) and 115 transactions completely invalidated. While we cannot know whether these were merchants, exchanges, or individuals transacting, this matters little in the face of real double spending scenarios - someone lost real money."

https://www.eddieoz.com/monero-under-attack-how-the-community-responds-to-selfish-mining-attacks/