I thought (not sure) that what usually happens is that people are complacent and they keep re-using their login and password at many websites where they have accounts.
Let's say you have your login as your email account, which is pretty common.
Then, because you're human, you decided a few years ago to use the same password (complicated or not) on a bunch of websites so you wouldn't keep forgetting the password.
So, over time the situation looks like this:
Code:
Web site Login Password
Web A abc@me.com 123
Web B abc@me.com 123
Web C abc@me.com 123
iTunes abc@me.com 123
So, the hackers are smart - they know that loads and loads of people have iTunes accounts, and they also know people are - for lack of a better word - lazy - when making up logins and passwords.
They also know that Apple's security doesn't need to be breached. Why bother? Just get the logins and passwords on Site A, B or C.
Heck, you can also set up a website yourself to collect login/password info. Or there's an unscrupulous website that's actually sold the login/password info to someone. It could be anything...
So, now that you've hacked a website and gotten the login information, you can just go ahead any try those very same login/password combos on iTunes. Many of them will work.
You can see that there doesn't need to be a keylogger or malicious virus involved. Nor is Apple's security necessarily breached.
Protect yourself from this sort of attack by using a different login for important/trusted websites (banks, iTunes etc). Sites which require a valid email address for the account login aren't necessarily fraudulent, but they certainly aren't helping... And of course USE DIFFERENT PASSWORDS on each website. Changing passwords periodically is helpful as well.
Another protection is to not use Paypal. Apple's quietly instituted a change whereby the security code on the credit card account needs to be entered at various times - the hacker won't have that (most likely) so they're booted out and you get informed of suspicious activity. Paypal has no such code.
Or, you can go the gift card route and limit your exposure that way. There's also no security code on gift cards but if you keep your balance low there's really no risk. If you get hacked, change your password and be on your way.
