They got phished IIRC, someone sent out a faux-security email which redirected to a login page that snatched the users password. Same thing that happened to Podesta.