Comment by rendaw

If it was a known leaked database, they should have invalidated the passwords from the database before attackers exploited them.