pull down to refresh

The article says they got access to victims' email accounts. I wonder how.