There are quite a few methods, but the four main ones are as follows.
Open vulnerabilities are often to blame, either in the software running the website (Apache, PHP, IIS, etc) or the code (SQL Injection, buffer overflow, etc), or the operating system itself.
There's also the possibility of using an intermediary system such as an infected workstation or vulnerable firewall to access a web server that may not be as protected from threats posed by "trusted" systems.
Inside threats, from disgruntled current or prior employees, provide an attack vector that is extremely hard to defend against. This is especially true when the employee has a high level of access, such as a sysadmin.
Finally, social engineering can play a large part. Convincing someone over the phone that you need a password reset for "your" (wink, wink) account is a common one, but there are innumerable possible cons that can be run on an unsuspecting organization.
Sometimes it's a failure of the sysadmins, sometimes it's a business decision to not finance security, sometimes it's a matter of a stupid user or two. Against a determined, financed adversary, any system will eventually succumb. It's just a matter of time because there is no such thing as perfect security.
If you want a nutshell answer to how to be safer: Keep all software up to date with the latest security patches, review all in-house code, train all your employees, and limit the amount of access to what is absolutely needed by employees and systems. Hiring competent people (technical or not) and treating them well also helps immensely.