Regarding the title of the article, the attackers stole the source to "Gaia", the single-sign-on system used by Google, and could potentially find previously-unknown security holes in it.