Hackers collect stolen login details from thousands of smaller breaches and merge them into massive databases.
Files like this are rarely the result of a single hack. Instead, they are often or compilations:
These are usually stored as plain text files ( .txt ), allowing attackers to easily run automated scripts to test the credentials.