The vulnerability exploited by the attackers occurred hours after the last update of Hi released yesterday. And according to statements of MyEtherWallet, the attack was recorded with a Russian IP.
Also, the developers reminded their users that MEW "does not have personal data, including passwords", so their users can be sure that hackers will not get any information if they did not use said VPN. However, at the moment the scope of the attack is unknown and some Reddit users claim to have been hacked without using the VPN of Hi .
It is important to point out that this is the second attack for MyEtherWallet during this 2018, after the incident on May 24, which presumes that during the hours of the attack the hackers had the opportunity to manipulate ethers wallets. According to official statements, MEW suffered the hijacking of some DNS servers that redirected for hours to a site of phishing. In turn, in October 2017 was the first object of an identity theft or phishing in which more than 15 million dollars were lost in ETH.
All in all, the attacks that MyEtherWallet has suffered in recent months have not been directly linked to vulnerabilities in the code of the wallet, but to services already linked to phishing.