This is a good question. From what’s been released so far it looks like attackers were able to remotely steal authentication tokens, which are normally stored securely in your browser. With these authentication tokens, the attackers were able to access user data, and even in some cases they were able to take over administrator accounts.
From the post that Admin‘s made after the breach was fixed it looks like they spent some time trying to clean up the damage that was done. From what I can see they cleaned up most of the obvious stuff. That said there’s probably a long tail of smaller stuff that they missed that. Still hanging around out there if you notice something report it to an admin.