Every single person on earth has had their passwords scraped as of last year. This information is semi-public, in that you can download the databases if you know where to look. It has reached the point where you should not be using your real name on anything, ever, and any passwords of importance should be rotated regularly. The non-public data, available in software suites that you can plug "classified" databases into, like Analyst's Notebook or Palantir's UI, contains even your current passwords. The state of things is pretty bad.