I've heard that almost nobody could hack MyEtherWallet it's just like a one in a million chance, but the wallet can be compromised.
Phishing - when you reveal your secret key or phrase and JSON file.
Mirror-phishing site with fake address or DNS - it's also a way to get into your account.
I mean hardly anybody can brute your password.