We had a similar case - National security authority(NBU SR) of a neighboring country got their public web infrastructure hacked after guessing credentials (nbusr:nbusr123). In the end, guys got free after trial because police were unable to unambiguously identify them.