So can passwords be "hacked"

As in without breaking into the nexon database like last time. Or do hackers just brute force your password or something? I'm not really sure how this nonsense works, but I'd like to know just whether a ridiculously long password is actually secure or if I'm just wasting my time here...