Ask HN: How databases are compromised?

I just saw this: https://news.ycombinator.com/item?id=9277370 about SlackHQ's database being compromised. I want to understand what are the different ways a hacker might get access to the database. As a general practice, you should put firewall in front of db to allow access only via your web servers. So what are the different ways to get access?