There were some accounts that were hacked during the security breach SE had with their network. Some of those accounts did have security tokens on them