Yes, it's 2016, but they say that passwords were collected in 2011-2012/2013. Also, phrasing in Russian sources suggests that passwords were not dumped from DB, but actively collected by other means.