alt Hacker NewsWhy would you think active directory has anything to do with this? That seems like a super random conclusion.
What happened is they found the password and email for an employee in a dump online - possibly for a different service, we don't know. If so, then the password was reused.
I mostly agree with you, but it's worth considering that there are much more fundamental issues with absolutely abysmal passwords like "123456" . If my password is "ra1nbowC0okies776", and it shows up in another place, it's a pretty strong signal that I reused it, because it's unlikely to have been picked independently by someone else. If my password is "password", even if I never reuse it, that's still far worse than me reusing the password above.