Armed with password hashes and salts, attackers could already be kraken those creds