“Threat actor” is more formal. Hacker is a more colloquial term with historically ambiguous meaning.

I don’t even understand the phrase? Are they a threat or are they only acting? It’s a Jerry Seinfeld routine.

Because they never actually hack anything. Either they fish someone’s password, find an email and password combo someone reusedfrom a different site, or someone left root with ssh access and a default password.

Why wouldn’t it be? Leaks happen every month, and everyone has been listed in at least a few. It’s not really a problem, so long as you use a unique password for every service, and change your password when notified you’ve been in a breach.