They have the db dumps, so yes, they know the usernames. And they used a rainbow table[1] to break the md5 hashes, which is a lot cheaper than brute-forcing.<p>[1] (<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Rainbow_table" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Rainbow_table</a>)