It doesn't sound like they have been hacked directly. This looks like the same things as TeamViewer where hackers are using password lists from other breaches to attempt to compromise the high value remote desktop targets.