There is nothing that cannot be hacked as long as there is outside access. Hackers do not care about 3 times and out passwords.
What they get are the encrypted password files and then run that against data bases that compare against the known equivalent plain text. They don't even have to know what security encrypted it as others have encrypted / unencrypted millions of possible passwords.
Computers run for days doing nothing else.
It is unbelievable how often a server is put on a network and then unsecured and forgotten about. That is so often a point of access for hackers.