So you are using AES-256-CBC for the encryption cipher, and someone was able to break in through VPN?
From my limited understanding of this stuff, AES-256-CBC is quite secure, and its really hard to crack, so having someone do it a couple times in a few minutes seems strange, unless they are...