We just posted more details on this incident: https://github.com/blog/1698-weak-passwords-brute-forced