SSL doesn't stop site hacking. SSL does two things (in theory, anyway—the second one can be iffy): 1. it prevents anyone from eavesdropping on the messages being sent back and forth between your computer and the server and 2. it proves that the server is in fact who they say they are. It doesn't prevent damage from being done to the site itself.
There are really two types of site breaches/hacks. The first involves the web server itself being compromised and vandalised (either overtly, as Anonymous likes to do, or subtly, by planting a redirect or a trojan download). This kind of attack need not lead to passwords being compromised (unless part of the vandalism includes hijacking of the site's login form, which it could).
The second type of attack goes straight through to the database behind the site, often through what's known as an SQL injection attack. This is how passwords usually get stolen—by lifting them en masse out of the site's backend.
It is normal practice for any website to store, not actual passwords, but the output from running what is called a hash function (think of it as a type of one-way encryption, or if that's too technical for you, as a word-fingerprint) on each password. However, a modern gaming PC can run the simpler hash functions
billions of times
per second, and many sites do use weak hash functions (often MD5, which was never meant to be robust). That means that it's practical to just throw a really long list of common words and popular passwords discovered in other password breaches at the list of hashed passwords from the website—unless every single user was very, very careful, sooner or later, something is going to match.
Any password of six characters or less can be guessed pretty quickly by simple brute-force methods.
Banks can be particularly vulnerable
if whoever's running their website is required to use the same authentication scheme as was built into their 1960s-era COBOL backend.
Further reading for the terminally bored:
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/
