The password manager giant said hackers were able to "brute-force" its two-factor system, allowing them to access customer accounts and download their password vaults.