[zelse]

HaveIbeenpwnd says it was just passwords/usernames/emails, so seemingly not. (My company just got an email from them about the breach and I confirmed I'm in there with a quick search on their website.)

[bigiain]

That's what Troy got sent. It's not necessarily all the attacker took.