They didn't get hacked, but public Google DNS got compromised. Their addresses 8.8.8.8. and 8.8.4.4. were down in some parts of the world, not sure if they still are. An attacker hacked into those addresses and pointed MEW domain name to a different IP. That is how when people opened even their bookmarked MEW URL, they went to a compromised IP and when they entered their private key, the hacker snatched it (because it was entered into his own server). The certificate should have warned people from doing so (because the certificate was missing and was not green), but it is easy to be a smart now, when things are over.