According to the original source (linked in the article), the credentials are plaintext from infostealing malware, not centralized breaches.