Explanation
One possible cause for the incidents in which attackers are able to access sensitive data from a corporate application's database is that the account credentials used by the web application to access the database are compromised or leaked. The log confirms that the attackers are using the WebApp user account to assume the DBA role and execute the GetData API call, which could allow them to retrieve any data from the database.
The account credentials could be compromised or leaked due to various reasons, such as weak passwords, phishing attacks, code injection, or insecure storage or transmission. Therefore, one action that will most likely prevent future compromises is to rotate the account credentials, which means changing them periodically or after every incident occurrence. Rotating the account credentials can reduce the risk of unauthorized access by invalidating the old or stolen credentials and enforcing strong and unique passwords for each account.