From the article it doesn't sounds like it was anything to do with the db.

Looks like they were processing the logins using GET instead of POST, unaware it was logging all the requests. Then the log files ended up on an ftp server for anyone to download.