Assuming the source of the credentials (malware, other breaches, etc) is correct, 320k isn&#x27;t outlandish by any means.<p>My Twitter bot, @dumpmon, comes across thousands of leaked creds per day, and that&#x27;s only on pastebin.<p>This, combined with &quot;checker&quot; services that can verify credentials to services like TWC make things like leaked credentials be correlated into &quot;from these x unique dumps, we have a group of creds that all work with TWC as well&quot;.<p>My guess is that TWC was alerted to a file someone was trying to sell that took leaks from other public&#x2F;private dumps or malware infections, checked them against TWC, and verified that they all happened to work. This would be why TWC wouldn&#x27;t be able to pin down an exact source - there absolutely doesn&#x27;t have to be just one source.<p>It happens more than you think.