This is the prevailing theory on ResetEra. Old Nintendo Network IDs set up on 3DS/Wii U were linked to Nintendo Accounts for use on Switch. Once linked, the NNID is a federated account and can be used to log in to the Nintendo Account. Changing the Nintendo Account password doesn’t help as the NNID is a separate username/password combination. It explains why many people changed their Nintendo Account password and were compromised again shortly thereafter. It also explains why randomly generated Nintendo Account passwords weren’t making a difference.

Having 2FA enabled seems to protect both login methods.

Nintendo has now issued a statement (Google Translate) confirming up to 160,000 Nintendo Accounts have been affected by the recent breach. Nicknames, date of birth, gender, country/region, and email address information may have been viewable by hackers, the company says. There's no indication that credit card information was visible to hackers, though, even as some accounts may have seen illegitimate purchases through linked payment information.

Nintendo says it has discontinued the ability to link outdated Nintendo Network IDs to Nintendo accounts, which appears to have been the main vector for the credential-stuffing attacks. Compromised Nintendo Network IDs will have their passwords reset automatically.

Nintendo continues to urge its users to activate two-factor authentication on their accounts to prevent any further breaches.