Valid credentials from somebody else’s breach, accepted. Nothing failed in the conventional sense, and customer data went anyway.
14,000 accounts to 6.9 million people. The multiplier was a feature, working as designed.