While it's possible (though it's very hard to) they hacked, it's unlikely.
PokeBank/Transfer was released for a short time in Japan, and whoever got the apps can use them even though they aren't on the E-Shop any longer.
It was released Christmas Day in Japan and immediately saw huge demand, making the service overloaded.
The apps have now been removed from the Japanese eShop and have been delayed elsewhere (America, Europe and Australia). Anyone who downloaded the apps already can use the service. The trial period will be extended to accommodate this.
The DB homepage
So, yeah, most likely they were transferred by people who got the apps before they were taken down.
