My guess is that all affected accounts are those that had multiple successful and/or unsuccessful login attempts coming from the same source.