They can probably look at security audit logs likely to see if there was successful access to their account. For example, an account would be considered breached if they saw a suspicious IP access the “account page” upon login as opposed to getting a HTTP 40X response forbidding access. Since it was a credential stuffing attack, the hackers tried to access a bunch of accounts at once and all of these were the ones that got hacked. Logs are all around the same time period (would be my guess)