Even if that is the case, why is it exposed to the public? They firewalled it off almost immediately, so I assume it didn't need to be... Never expose anything

Even if that is the case, why is it exposed to the public? They firewalled it off almost immediately, so I assume it didn't need to be... Never expose anything that doesn't need to be, SSH tunnels, openvpn... heck, use HTTP authentication wrapped SSL tunnels if you have to. Web servers tend to be more secure than webapps. Mistakes like this are far too easy to make. So anything that isn't part of your business application needs to be tunneled with authentication or isolated completely.