Presumably this is referring to him downloading one of many different data breaches that are out there, and yes, many of the services that have had their passwo

Presumably this is referring to him downloading one of many different data breaches that are out there, and yes, many of the services that have had their password databases leaked had terrible security practices. Couple that with password reuse across services by the victims and he'd be able to guess passwords for the services he was actually interested in based on the passwords he got from the data leaks. Also, note that the article is probably misusing the word "encrypted"—you usually hash passwords, not encrypt them, and plenty of services will have used a bad hash function or failed to salt their passwords, opening them up to easy brute forcing with rainbow tables [0]. [0] https://en.wikipedia.org/wiki/Rainbow_table https://en.wikipedia.org/wiki/Rainbow_table