Whose tax records are exposed in the IRS hack?

Factual Questions
1

I don’t know how to interpret this story–I see the thieves accessed taxpayer records via “Get Transcript”–but does “Get Transcript” give the thieves access to all taxpayer records?

APNewsBreak: IRS Says Thieves Stole Tax Info From 100,000
http://abcnews.go.com/Politics/wireStory/apnewsbreak-irs-thieves-stole-tax-info-100000-31317464

Thieves used an online service provided by the IRS to gain access to information from more than 100,000 taxpayers, the agency said Tuesday.

The information included tax returns and other tax information on file with the IRS.

The IRS said the thieves accessed a system called “Get Transcript.” In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address.

2

Based on my reading of the linked article, it doesn’t sound like the system was hacked. Instead, the thieves used personal information (name, birthdate, ssn, etc) that they had compiled from other sources to request the records as if they were the person whose information they were accessing.

In short, they were able to access the data for those users because they had the correct username and password and not because they were able to breach security and access the underlying databases.