The accounts fell victim to credential-stuffing attacks, according to the New York State AG.
Threatpost