It happened to not so long ago, and another dude here too the same days, can't remember the name of the topic he opened. I don't use the same password twice and I don't use weak passwords so I am a little septik with their system. I didn't have coins stored there so I didn't lost anything. Contacting them they will just offer you to lock your account the time you change your password ect. But you got stolen it's a bit late. They should set a system o whitelist IP, so for exemple only our IP can access the account.
I got hacked too, both on bittrex first and yesterday on poloniex....luckily i had no coins in there....i used those websites mainly for monitoring crypto prices. i had no 2FA so i guess if i held coins i would definitely have to enable it. i wonder if with 2FA is safe?