The database containing the compromised passwords was ironically unencrypted and not password-protected itself, a report said.