They very easily got access to accounts with bad security practices of people.
All you need to do is have one breach somewhere else. Could be a newspaper you sign in to or a bank. Once this information is downloaded, these people now have your email and password. This gets sold to others. Now many people sadly use the same email address and password on all there internet sites or accounts. So if the person with this information goes into the Ring website and uses the email and password, they most likely will gain access to the account. If you have 2FA turned on though, it won’t work and you will get a text saying someone asked for the code. Sadly again most people won’t turn this security feature.