I have heard of more servers being hacked through exploiting apache recently, aside from that more than likely they just did not have the proper security updates or firewall settings. Lack of monitoring a server can result in not being able to prevent someone exploiting the server before it happens also.