The backend of the system is MACS or what's now called ecometry from Smith-Gardner. The main part of the system runs on an HP3000. Since until recently there wasn't a secure web server on the 3k they used NT/IIS to front end the system on the web.

So was it actual access to the 3k?
A problem with NT/IIS?
A weakness in the S-G software?
Bad home grown code on eggheads side?
Poor security practices?

The later is my guess... it would be rather hard to get to the 3k if it was firewalled properly.

By the way the Smith-Gardner software is fairly widely used... if you don't believe me take a look at http://www.ecometry.com/clients/cl_list.htm