Hackers access 16 million email accounts

I'd disagree that security == transparency. You can not have security without transparency, but you can certainly have transparency without security.

As for the idea that they are "phishing for active mail accounts", I find that pretty far-fetched to be honest. What use would a vast list of email addresses of normal people be of use to them? To spam them?

I'm not sure how to read security == transparency. Now bear in mind that I tend to favour radical transparency, e.g., in government reporting and accountability, provided that it does not override personal privacy, i.e., data is anonymized, masked, etc....

But there are many cases where transparency != security, or perhaps a better way of putting it would be transparency XOR security.

For example, witness protection programs, police informants, classified military and intelligence information, etc.

In all of these cases, there should be a certain transparency of program governance and policy, with ZERO transparency of program procedure and information details: If you have no need to know, you get to know exactly and perfectly nothing, lest people die.

Like it or not, there are times when transparency is the enemy of security. The trick is documenting those cases well and implementing appropriate policy, governance, and oversight. It's quite a trick.

The article is light on the details. Apparently, the addresses were gathered from defunct botnets. You're right that there's no evidence for this, though I'm not sure what kind of evidence you expect. I think the idea that this is the BSI gathering active email accounts is pretty preposterous.