If unconnected services are being breached, the likelihood of this breach coming from some sort of a password manager is high. If that’s true, the recklessness would be beyond comprehension.
>Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. A popular tool used by cybercriminals, an infostealer is designed to grab usernames, passwords, and other sensitive data from breached sites and servers.
The sites aren't being breached. They're intercepting passwords and PII on the user's side.
The most likely source is a web browser's password manager.