I'm guessing browser credentials harvested by multiple malware infections since there are several independent datasets. Since browser cookies and URLs are present, it seems unlikely this is from a single service or password manager being breached.