My understanding was that some iCloud account login endpoints (associated with Find My iPhone) didn't have any rate limiting for password failures, and this allowed brute force to work for targetted accounts.

Apple also released a press release[1] saying that they “have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone.”

[1]: http://www.apple.com/pr/library/2014/09/02Apple-Media-Adviso...

The news on it has died down over the past year, with a recent items search bringing up only links to pron sites hosting the content. This is the best summary I could find: https://www.nikcub.com/posts/notes-on-the-celebrity-data-the...

It clearly shows that iCloud was very susceptible to basic social engineered attacks. Their statement on the subject is vague and misleading. There was no breach of iCloud passwords database, but if somebody just "guessed" the answers to the security questions, that counts as a breach for everybody else.

FBI has made one arrest and the investigation is still on going. We probably would not know until it's over, but at least one celebrity, Kirsten Dunst suggested her images were taken from the iCloud: https://twitter.com/kirstendunst/status/506553772114317312

Again, what most articles you have besides Apple's hand waving?