Yes, usernames can be cracked

A team of French security researchers are warning that cyber-criminals may soon be able to determine the identity of an individual simply by cracking his or her username.

Mozilla accidentally posts usernames and password hashes

Mozilla has confirmed that a partial database containing usernames and password hashes belonging to users of was mistakenly left on a public server.