Reply to post:

"The bad guys either exploited some as yet undisclosed weakness elsewhere on the server or did an inside job."

Or the bad guys exploited a well known issue with an available fix that wasn't applied.