The deed was done by the Chaos Computer Club hackers organization. When explained how, it does not seem too difficult:

– they took a camera and removed its infrared filter,
– then they used this camera to take a picture of the Galaxy S8 owner’s eye,
– next, they printed that picture with a high-quality laser printer,
– hackers then put contact lense over the printed eye, so that its shape can be emulated,
– lastly, they put the properly prepared picture against the Galaxy S8’s iris scanner and unlocked the phone.

The whole process can be watched here. True, an average citizen would have a hard time accomplishing this, mainly because camera with removed infrared filter is hard to get (though modifications can be made yourself), as well as the high-quality printer. On the other hand, this also means that this average citizen’s smartphone is safe, at least from this particular way of breaking in. It would be simply too bothersome.