It's not dependent on the first breach. If I understand correctly that it only requires an email address and birth date to change someone's password, then it wo

It's not dependent on the first breach. If I understand correctly that it only requires an email address and birth date to change someone's password, then it would be pretty easy to grab all of that data from somewhere like Facebook and run it through.