“We are still in the process of investigating the number of inactive, invalid and test accounts involved in the incident,”

So basically their whole main user database was stolen.