I'm sorry NixOS, I've failed you.
This was not a single company breach, the credentials were harvested from millions of infected user devices using infostealer ...