Originally Posted by plunet

Yep, we're all quick off the mark to blame the provider for leaking a password and whikst there are a large number of websites need to their game, the balance probability these days is that malware on an end user device has sniffed the password and compromised it more often than it being compromised by the service provider.