Security researchers at Trustwave’s SpiderLabs found a Netherlands-based Pony Botnet Controller Server with almost two Million usernames and passwords stolen by cybercriminals from users of Facebook, Twitter, Google, Yahoo and other websites. Facebook was the worst impacted and two Russian Social Media sites i.e. vk.com and odnoklassniki.ru, credentials were also included in the database. It is not clear how exactly the login credentials were originally obtained, but one possibility is that, they were captured using some keyloggers or similar malware.
Source: https://thehackernews.com/2013/12/two-million-stolen-facebook-twitter.html