Okay. "hijack accounts" is a bit harsh. Heartbleed allows a call for a random packet of about 64 bits of data from the OpenSSL system within the server. However, it can be called again and again and again, and MAYBE a hacker could patch together some data that would allow them to access secure data. It's also just one version of OpenSSL (that unfortunately a lot of people used)
However, what's unfortunate is that this hole in security is obvious when you do a network brown townysis on the server.