Patch all the things.
"The breach occurred when a cybercriminal managed to exploit a known vulnerability in HPMB’s Microsoft Exchange email server. Although Microsoft had issued patches for this specific vulnerability months earlier, HPMB did not apply them in a timely manner."