There was no stolen password literally. We grant permission without letting our password revealed (OAuth). Not “hacked”, only “careless”