As I said when I previously commented. I find it pretty ironic that these kind of breaches could have been avoided by simply creating a whitelist for their admin panel. This isn't rocket science. The majority of breaches of these size that keep occurring are password reuse, or open admin panels (bruteforce attacks). Who needs a vulnerability when an attacker can simply look up the Administrators on databases they already have?