It depends on what you mean by 'hacking' a VPN. One assertion in this breach is that the NordVPN certificate private key was leaked, allowing anybody to spin up a NordVPN server that would pass HTTPS certificate validation (the cert is expired, it's currently unknown if the cert was valid for a period of time after it was compromised). This kind of an attack would let an attacker convince most users to download viruses, input credentials, etc.

Nord says that the above issue was caused by a data center breach. Depending on the company this may mean a leak of user info (account details, emails, etc) and password data (generally secure hashes, but often insecure/near-plaintext passwords).

There's a lot that can go wrong here even before considering the MITM vector. As far as that goes, you can generally trust that well-secured sites (Google, Facebook, etc) won't allow someone to steal your session tokens/passwords. There is a high likelihood that a malicious VPN would achieve script execution on your machine in a short period of time.