Probably password reuse, then leaked. Like you'd see on https://haveibeenpwned.com/