you could still hope it's a WAF issue or they're hashing passwords through the database query, though both unlikely