Oh come on, why are they..

[LunarEmerald]

They aren't "hacking" accounts. The word hacking is commonly misused. They're phishing or cracking (brute force) account information.

As long as you're careful where you input your password, avoid shady sites, never tell ANYONE your password or information that can lead to someone guessing it, don't use the same password on different sites and have a password not easily guessable; You're pretty safe. They aren't literally hacking into Square's servers and retrieving your password. They're acquiring it through other means of your own self negligence.