How do hackers obtain the hash?