I will add another bullet point:
- Stupidly: when people use the same password everywhere, especially on that not so secure website
A while ago someone asked me to check their website's security, so I did the usual lazy thing and entered quotes in every form field. It turned out it was possible to inject SQL into the WHERE clause of a query whose results were not displayed. It was a bit cumbersome since all it could return to me was basically a single bit, if I hacked the WHERE to return more than one row it would throw an ERROR 500, otherwise not.
Fortunately you can access information_schema with that, so python script asked questions like "is there a table with name LIKE 'a%'"... and with a bit of dichotomy I soon had the whole database schema. Unfortunately the passwords were hashed and salted, but there was a table named "users_backup_old" which was soon dumped also, again through the single-bit-at-a-time hack. That took a while.
It contained all the cleartext passwords, presumably from an older, less secure version of the software. So the first instance of stupid is, your password in on a backup somewhere, or maybe on a USB key that fell off from someone's pocket somewhere. Or maybe it is in a GET request in a webserver log somewhere. Or in the proxy logs. Or in the NSA logs. Of course GET should never be used for that, but... Maybe spyware looked at it, logged it, then immediately leaked it without caring. This stuff leaks all the time, on the floor, everywhere.
Then, well, the table was named backup_old which means most of the passwords had been changed since then, but I still got to read his boss' emails on his company's Office 365. This guy had a very secure password with lower case, upper case, numbers, and even an exclamation point. When you went to the trouble to make such a strong hard to remember password, it really makes sense to use it everywhere.
Obviously his paypal password was also the same.
So basically it's pretty rare that a big name website gets hacked and passwords sucked out of it directly. But since people use the same password and email everywhere, all it takes is one insecure obscure website that gets hacked, and there are tons of those.