The security team blocked the IP addresses used by the dictionary attacker before any accounts were compromised.