There have been several major breaches of security in recent months, such as the log4j vulnerability, that could have allowed malware to end up being spread to quite a few people. If your computer has been compromised, KeyPass files are among the list of items malware will attempt to send back. There are also secondary attacks which might have resulted in capturing their master passwords without needing to steal a KeyPass or similar file (such as key loggers). Given the scope of recent breaches it seems likely to me that there should be a sudden cluster of users whose passwords were individually compromised.