Unless I missed something I don't think RSA/EMC came out and said publicly what was stolen earlier this year when they were compromised. So I know the answers to this question will be conjecture. That being said, how would any information that was taken from RSA allow somebody to login as an end user in an organization that was using SecureID? Wouldn't the attacker need the mapping between the username and the serial key of a specific token? And if the attacker did have that info wouldn't the attacker need the PIN of the user? People always are using a PIN with the access code from the token, right? Otherwise you have reduced it to single factor auth.
Maybe social engineering is the answer. Is there anything else I haven't thought of? Thanks in advance for the insight.