Technically it is possible yes but this question is both too specific and too vague to give a proper answer i feel.

A hacker could be exploiting security vulnerabilities in the software/website or employing phishing techniques to trick you into giving access. This way they don’t need a password or virus.

Its also possible that a chunk of your account data got leaked and they have that data rather then full access.

Is there more context to this story?