Getting hacked twice in short time doesn't automatically mean incompetence. There could be literal dozens ways of entry - including all the third party javascript services they run. Also we don't even know if the attack was done using a 0day exploit.

A sign of incompetence would be if they had their whole database wiped out and they did'nt have any backup (ala codinghorror.com) or they got hacked exactly the same way 1 month from now.

Getting hacked 2 days in a row only means they couldn't find the weakness yet. 48 hours is not a long time. Twitter gets hacked more often than this.

They very well could be incompetent, but you are judging too soon.