I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?