Is someone trying to hack into my SQL Server Database? I was asked by a friend, who isn't technical at all, to help her with her application.

I thought I would just being doing a little C# development and some SQL queries. Turns out it has been a lot more than that. Needless to say I've learned a lot.

I've stumbled upon the Server Logs in SSMS. To my surprise there are TONS of failed login attempts. The login attempts are primarily using the username 'sa' but there are others, for example: 'KHB', 'wwo' 'IIS' 'hpv7' 'N200user' 'kisadmin'. These usernames make no sense. I am the only one who should be logging into this database. The error is either.

Error: 18456, Severity:14, State: 8 or  Error: 18456, Severity:14, State: 5


State 8 only happens when the login attempt is for the username 'sa'.

The majority of these attempts are happening between 1am-4am.

This seems real fishy.

Any suggestions on what I should do?
Looks like somebody is really trying to hack into your SQL Server with brute force attacks. I recommend taking a look at this Whitepaper on SQL Server security, that will help you a lot.

Since most attacks happen at the same time, make sure you don't have a security scanner on your network that runs its checks at that time. Products such as Nessus can perform security scans and simulate brute force attacks on your servers in order to help you fix the security issues they find.