But in this case the server was compromised, so they can sit at home and brute force the hashes all day long.