One click likely allowed hackers into breached database