“A POP server that had not been updated for security could have been exploited by the hacker to get usernames and passwords,” said a cyber security expert who did not wish to be named.