The Germany Federal Office for Online Security says law enforcement and researchers have uncovered a list of 16 million user credentials - mostly German - that have fallen into the hands of botnet operators.