My personal opinion: those hackers are probably not that clever nor smart, it’s just that companies doesn’t often properly follows security best practices despite storing plenty amount of sensitive information.