I think it's quite unlikely whoever took control of this managed to dump an entire database but couldn't access a password salt. Do we know for sure these were

I think it's quite unlikely whoever took control of this managed to dump an entire database but couldn't access a password salt. Do we know for sure these were "salted SHA"? It could well be "SHA1-HMAC through an HSM", and thus, actually be the stronger option. Alternatively, someone has probably kept a lot of cracked passwords to themselves.