Kuddos to the iThemes team for being so quickly proactive on this issue. Unfortunately no matter how much or how little security is on a site, this just goes to show that no site is ever 100% secure. That is the first lesson in security. While I am sure we will never know how the got in or exactly what was compromised, I have full faith that they will fix the breach.