The company says a list of user names and passwords ‘was likely collected from a third-party database compromise.’