It looks like IP addresses are stored in the DB in lemmy. It’s possible that the attacker had access to those IPs, but we don’t believe they accessed them. This is the sort of thing we would turn off if we could :\

From the admin