Everyone's focusing on the security of the password and iCloud, but I just wanted to take a second to say: fuck who did this. Yes he should have backups, but erasing someone's things is such a juvenile thing to enjoy.
Edit: Surprised to see Cloudflare is proxying their website. I understand wanting to be impartial, but I think it's fairly easy to draw the line at groups breaking the law.