[cd34]

The hacker used the FTP username/password to modify a few files on the server. Generally when that happens, the username/password has been leaked somewhere through a keylogger/spyware/trojan or, like this case, a vendor storing the user/password/hostname in the clear somewhere.

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

You would be surprised at the frequency this happens.