It's unclear what they found. They claim the breach is recent or ongoing but it's hard to confirm especially given the methodology - it sounds like they crawled and probed to find the data sets.