To all of you idiots blaming the victims out there right now "should have used 2fa, should have used stronger passwords":
1. You don't know if 2FA was in place, you don't know what strength the passwords were.
2. Again: those women were highly targeted. Can you defend yourself if someone takes a week/month long project to break into your phone? (Also this was during heartbleed and other big vulnerabilites)
Come off your bullshit high horse. Don't blame the victims here.