it could have been much worse, I have seen passwords leaked this way

("seen" meaning "I worked at a company where this happened and read the code with my own eyes" not just "I read it in the newspaper")