Best case scenario those kids were duped into giving out credentials to the wrong (Russian) people.