Data breach likely saw attackers obtain millions of students' PII via a simple password compromise, it seems.