Its in the video, The ledger was bought on ebay and it was already used. The person who sold it had the security phrase of the device before it was sent to the buyer. Then later used the phrase to recover the wallets and send the ripple out.

The ledger wasn't hacked it was just already in use when bought. So the security was compromised.