The company didn't reveal exactly how the breaches occurred, but the information released by the bank points to credential stuffing.