Could include phishing scams to get usernames and passwords out of someone. Could be just guessing at answers to security questions, Could be online social interactions that coax security data out of a person.

In any case the end result isn't that somebody's data was hacked or their chosen service had a data breach. Simply, the thief was able to get the sign-in credentials to get what they wanted.