That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack)

That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline). The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.