The images in The Fappening came from a variety of cloud services, including iCloud. I think the hackers were getting access primarily via social engineering.

There was an iCloud hole that was discovered around the same time as The Fappening, but no evidence that it was used by them before it was patched by apple.