The company says the access was enabled via a password that was shared with a compromised personal account.