> when I forgot to log out of the root console in web-based terminal console to one of my VPS and closed its browser tab instead.

This should not enable the compromise of your session, i.e. either there was some additional vulnerability (and not logging out widened the window during which it could be exploited), or the attack was totally unrelated. Either way, you should find out the real cause.