Some good points are made at the Schneier on Security blog: RSA Security, Inc Hacked.
The worry is that source code to the company's SecurID two-factor authentication product was stolen, which would possibly allow hackers to reverse-engineer or otherwise break the system. It's hard to make any assessments about whether this is possible or likely without knowing 1) how SecurID's cryptography works, and 2) exactly what was stolen from the company's servers. We do not know either, and the corporate spin is as short on details as it is long on reassurances.
Security is all about trust, and when trust is lost there is no security. User's of SecurID trusted RSA Data Security, Inc. to protect the secrets necessary to secure that system. To the extent they did not, the company has lost its customers' trust.
Updated to fix some misconceptions....
The SecurID access code calculations had already been reverse-engineered - see RSA SecurID data compromised and Cain and Able. The algorithm requires the token-specific AES key ("seed record") supplied by RSA along with the token.
The comments in Schneier's blog speculate on the possible implications. It seems likely that some sort of database of seeds for each serial number has been stolen, allowing attackers who know the serial number (printed on the back of the token) and can figure out the token's clock setting (e.g. by seeing a few access codes) to get the seed and calculate future access codes. If the SecurID is used alone for authentication, that's all they would need. If it is part of a 2-factor system, e.g. used alongside a password or PIN, this would reduce that to a one-factor system.
I'm amazed that SecurID has gotten away so long with so much security thru obscurity in their design! I wonder if they retain the seeds for all the devices they sell - seems like a big risk.
Update: Lockheed was attacked, reportedly via copied SecurID keys: Lockheed Martin Confirms It Came Under Attack – AllThingsD
Update: As @D.W. notes, Dan Kaminsky's Blog On The RSA SecurID Compromise has more complete discussion of the issues here, which generally agrees with the blog comments I noted here, though it doesn't give much weight to Schneier's fears of new attacks based on a hypothesized theft of source code.