The two were able to hack into the SEC’s computer systems due to phishing attacks that stole credentials and spread malware.
Source: Threadpost