Not a breach in and of itself, but it does give an attacker something they didn't have before: a list of attackable login names.

Now they can start trying common passwords on logins that they know exist, rather than having to guess at that too.