This smells like someone leaving a DB open to the world (remember the old MongoDB open by default?)

I think stealing a whole database raises very serious questions as to how technically this was done and how would you prevent this at your company.

Unfortunately "transparency first" aside, companies don't usually release this information which leaves us all wondering how we can better protect our users (outside of having sane defaults, closed by default, no ssh, private networks etc...).