The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.

We don’t know how the passwords are hashed. All we have is a journo guessing.