Several years ago I worked at a hosting company that was compromised via external and internal actor. The external actor used a vulnerability of WHMCS (one of many available, at the time).

To this date, the breaches were not disclosed publicly.