Twitter says a hacking attack on employees was to blame for one of its biggest ever security lapses.