Washington Post acknowledged that a sophisticated phishing attack against the site led to hacking of Web site.
This phishing page was used by Syrian Electronic Army spoofed Post's' internal email login page.
Here’s how the Syrian Electronic Army’s hack worked from Washington Post