The securid tokens are basically sealed, tamper-proof etc hardware pseudorandom generators. RSA knows the seed burned into the PRNG for every device they manufacture.
At customer premises, there's a RSA server component that simulates the same algorithm as the securid devices owned by that customer. This is how they verify that the number you enter is what it's supposed to be, hence proving that you possess the securid. To do this, the customer server needs to know the seeds of all of that customer's devices. This is a trivial computational burden btw, since securid generates a new number only once a minute.
I strongly suspect that RSA continued to store the seeds for their customer's tokens after selling them on an internet-connected computer on their premises. Somebody cracked into this database and stole the seeds for all RSA devices in use by all of RSA's customers.
Once the crackers have this information, they can predict the sequence of numbers for any device out there.
The only fix is to change the seeds: since the hardware is sealed, the only way to do so is to replace the tokens.
I think it's ULTRASTUPID of RSA to (1) keep the seeds after selling a device, (2) keep it on a internet-connected computer.
THIS IS A BIG DEAL, imho.