Money stolen through Partypoker

This just happened to a friend of mine, so I don't have all the details yet. My friend has an account on PartyPoker which he hasn't used in a while. Today he checked his bank statement, and found that a couple thousand dollars had been transferred out of his account, into PartyPoker, through IGM-Pay. When he logged into PartyPoker, there was only $60 left in his account. My guess is that someone found out his password somehow and transferred or gambled the money away to another account. My friend called PartyPoker and they said there was nothing they could do about it. I'm not sure if he's called IGM-Pay yet.

Is this sort of thing common? Is there anything my friend can do to get the money back, or is the situation hopeless?