This is the most likely scenario. Reusing credentials could also be a part of the problem. If you use the same login and password on two sites and one of them is compromised attackers will figure out where else they can use your credentials.