Cross posting from Reddit..
I was in the IRC channel #hashcows on freenode as this played out. Note that I don't speak for Hashcows, just a user/chatter reporting what I know.
Seems like what happened is that someone used an attack (possibly SQL injection) to change a bunch of user payout addresses to
https://blockchain.info/address/13R87ropkDKzDEuVeQoX64kkcLvPWVdTKHAs users subsequently hit their pre-set auto withdraw threshold, or logged in and blindly did a manual withdrawal for themselves, the coins were siphoned off to the thief's account.
This leads me to assume that no account details (usernames, passwords, PIN, entire database) were compromised.. it was a smart but simple attack, something of a smash and grab raid. They didn't need to deal with usernames, passwords and PINs (none of which would be stored in plain text anyway), this was much easier for them.
The first thing to do is check your balance. If it's not been affected you are ok now, as the payout system was disabled by admin as soon as this came to light, and will be until investigation is complete.
If you try to manually withdraw the website will report that the withdrawal has been initiated - but it hasn't.
For a period of time you may have been unable to change your payout address, as this was also locked by admin, however it's now been enabled again.