That's probably pretty close to the aggregate number of credentials leaked, and these leaks are easily downloaded or bought on the internet.

It wouldn't be difficult (and is commonly done) to create a large database of all leaked credentials.