The incident was first flagged by cybersecurity researchers at Malwarebytes --- who reportedly found the data during routine dark web monitoring efforts.