Take the OP. What defenses were breached? An old abandoned system running unmantained in the background with old user data still attached. There is no excuse.