Can he do anything besides read database connection which is localhost and not accessible via remote host ?
wp-config.php is an important file of the WP installation. It acts as a bridge between the WP file system and the MySQL database.
wp-config.php contains the database connection credentials. Apart from this, it can also be used for:
- Defining the security keys.
- To specify the database prefix.
- To set the default language for your admin panel.
If you have been hacked I recommend looking at: https://codex.wordpress.org/FAQ_My_site_was_hacked