A security researcher said the breach appears to have originated from a Russian cybercrime syndicate.