As far as I can tell they trawled a big archive for sensitive information, (unsurprisingly) found some, and then didn't try to contact anyone affected before telling the world "hey, there are login credentials to be found in here".

Google has a great aid to reduce the attack surface: https://github.com/google-research/arxiv-latex-cleaner