They got hacked and didn't even reset customer passwords, very glad I use unique passwords and limited the blast radius to them.