Users use the same passwords everywhere. By cross-referencing user passwords through excessive brute force you could find accounts on other sites that link to a user’s personal data.

Is the password personal data?

You have to draw the line of correlation difficultly somewhere.