Because it wasn’t a breach, the title is misleading. It was just credential stuffing.