While it's still possible that even complex passwords were discovered through alternate methods It's hard to say that is more likely than Apple's iCloud servers being compromised. I'd expect Apple to have used the same security methods that have kept iTunes servers secure over the years and I wonder why it seems to be limited to so few users if it's an account server hack which should open up millions of potential user accounts. A bit off topic: One thing I'd like Apple to add to iCloud is to see what devices and what IP addresses (for web based access) are connecting to iCloud for any services. This is important because my Mail, Photos, iMessage, Contacts, Calendar and Find My iDevices are all syncs via one account which makes it easy for a single person to spy on your activates and whereabouts.