Did you have a strong (10+ character, alphanumeric) password on the device they were able to get into?