Until recently, cybercriminals could have hijacked the account of any GroupMe user simply by knowing the phone number connected to the targeted account, a researcher reported on Thursday.