Attackers were just using credentials that were leaked in other data breaches to access Nintendo Accounts (Switch and mobile apps), by logging in via a linked Nintendo Network ID (3DS and Wii U).
If the password for your NNID had not been breached in the past (and then reused for the NNID), you wouldn't have been vulnerable. Enabling 2FA would also have protected you against this attack.
Nintendo has solved this by:
a) Resetting NNID passwords when they think someone has been affected
b) Disabling the option to log in to Nintendo Accounts using the NNID username/password.
It's strange, because Nintendo has such good first-party game development skills, develops entire operating systems for their internet-connected consoles (including security architectures spanning hardware/software).
Even some of Nintendo's top brass have had strong software engineering skills: in the late 1990s, during the development of Pokemon Gold & Silver, the team was struggling so future Nintendo President Satoru Iwata developed and implemented a compression algorithm.
Developing software that fulfills functionial or gameplay requirements is going to require a very different skillset compared to fulfilling security requirements (user stories become abuser stories, and they aren't always easy to wrap your head around).
Corporate Japan has also lagged behind western companies in this area. The book Business Management and Cybersecurity by Shinichi Yokohama dives into this.
And this is a service Nintendo charges for. How much of that is used to prevent things like this? Or maybe they just budget for the occasional hack happening so they can give people refunds?
