Article mentions the passwords were hashed with sha256 plus a salt. For a long password more than say 12 characters this would take a very long time to brute force. My guess is a lot of these were dictionary attacks ?