It's surprisingly easy to do too. A guy showed me a simple program once, he added a list of all the usernames then a list of all the most commonly used passwords then the program starts trying all combinations and before you know it, you have access to the majority of peoples accounts. There's not much you can do to protect yourself. I use different passwords for every site I use as if they get one of them, at least they don't have access to all my accounts everywhere.