The comments section as a whole involves some interesting discussion about the matter. The first comment under the article sums up my insight after reading it

The comments section as a whole involves some interesting discussion about the matter. The first comment under the article sums up my insight after reading it pretty well. Copypasting the most relevant parts: -------------- I had very much hoped for a less alarmist, and altogether more thoughtful and insightful discussion (with evidence) about how SciHub gets and uses credentials. It is an interesting opinion piece (read another thinly veiled SciHub hit job), where you very neatly make statements that conflate hackers with SciHub, without providing any real evidence to back them up. You talk about stolen credentials, and then lay the blame at the foot of SciHub- without any actual proof that they stole or hacked them. Yes they may be using stolen credentials (which I agree is very, very poor form and weakens their position, and importantly reputation), however you offer no proof that they are the originators of the theft or did hacking (do you have such evidence?). You discuss much about hacking, and very neatly avoid discussing exactly WHO did the hacking of university systems, very very likely nothing at all to do with SciHub (I would hazard a guess that 99.9% of university hacking is nothing to do with SciHub- admittedly i’m not an IT admin but i read a lot about this topic). But its a nice trick in your article to join the two.