You’re missing the 5/3 update about username and password credentials.

> our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts.

From the link we are commenting on.