The real lesson is there are multiple lessons. Layered security and risk management. Back up automatically, don't expose database, don't expose configuration fi

The real lesson is there are multiple lessons. Layered security and risk management. Back up automatically, don't expose database, don't expose configuration files, use tools to try and exploit your own site first, try to avoid passwords in files at all if there ways to do so such as credential stores, encrypt data at rest, no plaintext passwords. When one layer fails the next layer turns this from a catastrophe into a mere headache.