[tercmd]

The Pwned Passwords lookup returns just the number of breaches without any hashes or plaintext passwords. This would not make such an attack possible.

[agentultra]

That’s good to know. So they’re probably using old dumps.