(Quote)

(Quote)

(Quote)

(Quote)

did they encrypt the password (account) when storing in db?

(Quote)

(Quote)

(Quote)

(Quote)

If you haven't already (crazy if) please, for the love of god, change your root password. Leak DB contains every single fucking thing. And remove the crap qemu-guest-agent.

(Quote)

i think cpanel have some issue, i'm not able to login cpanel, just got:

I don't personally like managing that many logins in email clients/etc. I setup a lot of my less important domains in my DA/cPanel crates and use the standard mail, and my main domains/inboxes in Cran

(Quote)

I'm 99% sure what simply happened on your case is that you haven't removed qemu-guest-agent and prevented it from being installed again, and so they did reset your password and simply VNCd in.

(Quote)

(Quote)

Yes to VNC, and no to root password being the same. It's also possible they brute-forced VNC with the default password, as they set an 8 char password (which is the max surprisingly).

You probably left the default root password or qemu-guest-agent installed (from which they could've just reset the password and get in).

Did you leave your VNC password the same?