http://arstechnica.com/security/2014...ched-millions/

This appears to have been the source.