That sucks! But the real lesson should be that you do not expose your database on the internet (0.0.0.0 vs 127.0.0.1). That way it doesn’t matter if you leak your .env via your webserver. Never expose sensitive services.
Top hit on Google for how to setup a SSH tunnel for MySQL: https://linuxize.com/post/mysql-ssh-tunnel/
If your database is open to 127.0.0.1/{8,24,32}, it is open only to the local host; that is the non-routable localhost address and it's not accessible to the internet.
If your database is open to 0.0.0.0/0, it is open to the internet and anyone can attempt login. This is bad. Presumably you also still need a password, but never assume. Always have defense in depth - at least two things need to go wrong/be wrong before you're compromised.