Continuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000. If an attacker works off lists of

Continuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000. If an attacker works off lists of compromised usernames and passwords from various sites, for a given user there's always a chance that the first one they try is correct. Especially for the kind of user who recycles the exact same password on 50 different sites. (Incidentally, you should probably try to hack that kind of user first, and for each user, try their most-recycled passwords first.)