This type of attack is not going to stop.
For years, I've said anything with a 1 & 0 can be hacked. Then it came true, granted, I had some insider knowledge about Intel/AMD chips. Until we recognize that in a digital/computerized world, security needs to come first, second, and last, with application functionality in the middle we will always remain vulnerable.
Even then, creative minds will find a way to hack anything with a 1 & 0.
For a major city to be hacked it should get more publicity and be a warning sign for others to ensure they make it as hard as possible to gain entry.
Lastly, humans are mostly oblivious and trusting when it comes to social engineering and are the weakest link in most cases. Doesn't matter if you have a 14 character, upper case, lower case, number and special character with no dictionary words in your password. If you give away the right information or provide access to the right hacker, you're fubar.