Hackers are draining bank accounts via the Starbucks app

This is a little mysterious because none of the articles have addressed the exact vulnerability that enables thieves to do this. I've heard a news report suggest "changing your password". This is curiously interesting.