Evernote's official message says little about technical details of the attack and how it was detected.
0) Speculate: How did Evernote detect the security breach?
1) How can unauthorized database access with valid credentials be prevented and detected?
2) How can database or file storage data leak be prevented and detected?
If this are too abstract questions, assume:
- This is a rich client web application with database backend and Node.JS in between.
- Apache Cassandra is the primary data store and ElasticSearch is a search index/engine
- SQL Injection attack vector is not applicable or has been mitigated.