It ended up that there was an insider at a software company, the company that provides the interface between the financial institutions and these credit-reporting agencies, who left the company, but prior to leaving, stole a number of subscriber codes and passwords for all these financial institutions.