Although many security experts believe that the stolen email addresses will be used for spam email distribution (and to potentially distribute malware), the stolen log-in credentials are concerning - particularly because many users routinely re-use the same log-in credentials for multiple websites and services, including online banking, investments, and other important accounts.