How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)

* LivingSocial - [50 Million Users Exposed](http://it.slashdot.org/story/13/04/27/0132209/livingsocial-hacked-50-million-users-exposed)
* Zappos - [24 Million accounts accessed](http://money.cnn.com/2012/01/16/technology/zappos_hack/)
* LinkedIn - [Over six million passwords compromised](http://www.theverge.com/2012/6/7/3071707/linkedin-hack-six-million-passwords-leaked)
* Evernote - [50 million compromised](http://edition.cnn.com/2013/03/04/tech/web/evernote-hacked)

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up, and I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.