Arrington says the vulnerability was in Google Apps for Your Domain, although the original article about the hack says otherwise:

http://www.pcworld.com/businesscenter/article/164182/hacker_...

  Hacker Croll claimed to have accessed Goldman's Twitter
  password by first gaining access to his Yahoo account. 
  "One of the admins has a yahoo account, i've reset the
  password by answering to the secret question. Then, in
  the mailbox, i have found her [sic] twitter password," 
  Hacker Croll said Wednesday in a posting to an online
  discussion forum. "I've used social engineering only, 
  no exploit, no xss vulnerability, no backdoor, no sql
  injection."

I wonder why the hacker would send the documents to Techchrunch. He could have uploaded them somewhere and then submitted the link to Reddit.