It's likely that the compromised Equifax data was plaintext log files of people trying to log in for things like free credit reports or to dispute items on their credit reports, which contained all the data required to log into these parts of the website (e.g. names, date of birth, address, SSN, etc.)