how is it possible to hack such a password

Good and important question!

Hacking in the sense of going through all possible combinations to find the right one at some point is not impossible, but in my opinion the probability is close to zero.

It seems more likely to me that keys were entered on an unreliable site, e.g. Autovoter or another tool.

This means that we have to be very careful if we are asked to enter a private key anywhere, especially if this is the active or even owner key, not to mention the master password.

Another option is to grant authorisation to another account. For example, 635 users have currently granted upvu.web a posting authorisation. This should be fine, upvu.org needs this permission to authorise scheduled posts.

However, I find it worrying that (for example) 12024 users have currently granted wherein an active permission. As far as I can see, this is the app from wherein.io - I don't know why this app needs active permissions. This means that the app or the operators of the app can make transfers. I would think twice about that! (Don't get me wrong, I don't know the operators and I'm not aware of anything negative.)

So, we should also be very careful when granting permissions. As is often the case, you can find an overview of which permissions you have granted at steemworld.org.

Oh - that was a lot of text, summary:

• Store the master password and private owner key in a safe place.
• the other keys can be stored via SteemKeychain or a password manager on the PC/mobile phone so that they are available.
• be careful when granting permissions.

Stay safe!