Two failures in one story, and only one is getting the attention. 123456 is embarrassing, but you can fix a password in an afternoon. The other one is that nobody inside detected the exfiltration: the data was gone, and the first alert was a news article. For anyone holding identity data, the check that would have caught this is boring but real: auth logs, and a page when a single credential starts pulling more data than a human would. Compromise is the fast part. Noticing is the slow part, and it's the one you can actually engineer.