[fuddy]

I'm a but puzzled by their advice.. Given the variety, how do we know this data isn't from a password manager compromise?

[throw10920]

You're right - thee fact that Google and Apple passwords were both compromised (given how insanely good their internal security is) strongly suggests either malware or password manager compromise.

[loa_in_]

Given that it's likely from an infostealer malware it might be from user internet browser profile password databases.