Surprisingly, one culprit behind the leak is passkey technology, which is supposed to be a more secure way to authenticate data such as site logins.