username and passwords. Not sure why but they did and everyone knew everyones password do to the list. The guy went to Houston and kept the same password he knew everyone from the cards knew.
https://www.miltonsecurity.com/company/blog/2015/06/mlb-cardinals-get-data-breach-vengeance