That is the username and password that the web servers connect to the database on the database server. The username and password have been changed, but the site was never in any real danger. First, you need to know what the database server is. It just has a host name in there, not the IP. Even if the IP was there, it's an internal IP, so it's worthless unless you're on our network. Our db servers are locked away pretty well, so you can only access the data from the webservers. If you have access to the webservers, then it's fairly easy to get this information anyway. This is really only an issue if you're database servers are externally accessible, and ours aren't.

Still, the username and password have been changed. :-)