That wasn’t a data breach, that was malware:

> The records exhibit multiple signs that the exposed data was harvested by some type of infostealer malware.