Barix boxes come with NO default password, so if you plug one into a WAN port and it gets "found", it's all there in the open.
I handed the password problem to Barix, but never did get an answer as to how the box got busted into. A few of their other customers reported the same problem that day.
In the end, I stopped putting the gear that requires remote access on dedicated IPs. Don't know that it's foolproof, but a little less obvious, I hope.
Incidentally... this is not necessarily a Barix issue. Any box that can be remotely accessed and pull an MP3 stream could be vulnerable. Also, you can put IP addresses into the playlists of a number of automation systems now, so.....