Does the site use SQL Server? What I can see is that earlier less suitable client-side code has been optimized quickly. Attackers seize on the initial fault; others of us are impressed how quickly it got resolved.

I could reply with your M.O. ("why are you asking me which database they're using? Make an assertion and show some proof and we'll discuss it"). <s>

It's my understanding (I don't have proof, so I'll stand corrected if I'm wrong) that they're using Oracle. I actually cannot talk in detail about it, but last year I briefly did some contract work for one of the major health players and I believe there was some talk in migrating some major DB work from Oracle to SQL Server. However, those efforts were delayed, due mainly to challenges in documenting the functionality of the heavily patched legacy system.

It's really not relevant - SQL Server and SQL Server Parallel Data Warehouse scale just as well as Oracle - and you can have badly architected solutions in both technologies.