I agree it's not ideal that something so important wasn't at least only accessible by VPN but any decent IT professional knows to set a strong password like thi

I agree it's not ideal that something so important wasn't at least only accessible by VPN but any decent IT professional knows to set a strong password like this, because it's so easy to do so - sometimes you can't just use a VPN because of historic reasons or due to the complexity of the network but you can certainly set a strong password on a database server. Assuming patched, modern database software, that should keep attackers at bay until all the failed login attempts are spotted. It's very embarrassing that they (allegedly) did not do this. Of course, note that in this case it's a custom web application so it would probably be at least more of a challenge to compromise.