Microsoft says that recent thefts targeting Xbox Live users are isolated incidents, and often tries to portrays the problems as phishing scams -- effectively blaming the consumer. However, an eyebrow-raising amount of comments and emails seem to suggest that it's a big more common than that.
Microsoft has indeed tried to blame a variety of third-party services. One of my contacts said that a customer service rep blamed third-party servers, while FIFA 12 has been accused of allowing exploits to take place. The one unifying strand in all these stories is Xbox Live, however.
A security flaw on Xbox.com has allegedly been discovered by one victim, who learned that indefinite password attempts allows a hacker to force his way into any Gamertag they like, just by learning the corresponding email address (which Microsoft itself makes easy) and assaulting the site with a password generator. Whether this is how the hackers are getting in remains to be seen, but it's the most credible idea so far, and it once again points to Microsoft.
For right now, the only advice one can give to those users wishing to protect themselves is this -- do not have a credit card attached to your Xbox Live Gamertag. You can renew your subscription or add Microsoft Points using pre-paid cards bought in stores, without the need to open a conduit to your bank account on Microsoft servers. It seems to be the best way to keep yourself safe.
From what we've seen, this is a very real problem, but there are practical steps you can take to defend yourself. You're going to have to, because it seems Microsoft doesn't have what it takes to look after its own customers.
can cause it. You can fix it by adding *.disqus.com to your whitelists.