Is CiviCRM data vulnerable to the Drupageddon bug?
Since a potential attacker got access to the database, and through the evil php module, could execute code, everything on the same server must be considered compromised.