The employee who got hacked was both using an insecure password (the exploit needs access to an admin account) and his Plex install was 2.5 years out of date.