Great Western Railway accounts breached (uk) (bbc.co.uk)

Doesn't really say if it was brute force or they're using unsalted encryption.