Passwords are copied unencrypted to Google's servers. Users who secure their Android device and create a backup via Wi-Fi are at risk.
There are several million Android users worldwide. Companies are especially affected because their W-Lan password often matches their intranet password. However, individuals often use the same password across multiple accounts. Google has not commented on this.