Great Western Railway accounts breached (uk)

Doesn't really say if it was brute force or they're using unsalted encryption.