Got this info from 4chan.

"/vp/ here. If you folks weren't aware, a Pokemon fan site was hacked about two months ago. Every name on this leak are names on the older fan site leak, meaning this was probably people using close to the same password for both.

NNID wasn't so much hacked as it is the aftermath of another hack and people failing to change their passwords."

You should be okay if you never been to that website before. Spread the word.