by hit, do you mean de-indexed or just bumped down aggressively?
Cause the ones you gave seem to be affiliate sites, with thin content, and light design elements, so I can definitely see how these could have been devalued.
Here is the reason I am pretty sure it is not a "Hack Penalty"
First, I am not sure that exists - Google cannot interpret if you have been hacked or not, only if their is malicious intent on your site due to or after the hack.
And as to your password being readily available.. anyone could create a site like this, with passwords, and without google going through each page on the web like this, they would not know if it was real or not. (it is also very easy to brute-force or rainbow a commercial host)
This creates a whole new realm for Google as web avenger, as well as SERP integrity protector.
I am just not sure the password release could be involved.
UNLESS!
A penalty was leveraged against justhosts ENTIRE commercial subnet, due to a issue that was caused due to this password release.
But I do not think you or the sites would be singled out due to the password release, only if something bad enough happened that got Google's attention..
BUT then i believe you would be de-indexed, not de-valued.... (blacklisted)
hopefully this opinion was clear as mud