That's probably pretty close to the aggregate number of credentials leaked, and these leaks are easily downloaded or bought on the internet.
It wouldn't be difficult (and is commonly done) to create a large database of all leaked credentials.
It wouldn't be difficult (and is commonly done) to create a large database of all leaked credentials.
I've found over the years it's easy to tell when a story about security isn't all that true. A story without any actual evidence behind it, that sounds very scary, is almost never true.