It was broken much, much earlier. At first you required an external device (special cartridge) or hardware mods, but there was a software exploit via the web browser for over a year now.
In addition to being broken earlier, it's been trivial for even a casual user to pick up the exploits and use them to run arbitrary software on the device. There's a long-running website out there you can load in the 3DS web browser to exploit your device with a single click.