While 860,000 users’ e-mail addresses, user names and hashed passwords may have been accessed, the hacker says he’s not planning to leak the data.