The most likely cause of the data breach is hard-coded credentials being exposed in the public repository. If the developer accidentally included database usernames and passwords in the code and pushed it to a publicly accessible repository, attackers could easily find and use them to gain unauthorized access. This is a common security oversight that leads to database compromises.
Attackers often scan public repositories for sensitive information using automated tools, making hard-coded credentials a significant risk. Best practices include using environment variables, secret management tools (e.g., AWS Secrets Manager, HashiCorp Vault), and removing credentials from source code before committing.