Interesting to see that some companies do proactive audits by running a list of their current user emails against HIBP. I guess that was bound to become a thin

Interesting to see that some companies do proactive audits by running a list of their current user emails against HIBP. I guess that was bound to become a thing sooner rather than later. However, I also note that if such a company detects that an email address used by one of their users has been compromised on another site, that this fact is communicated carefully. Specifically I can see the confusion with the Digital Ocean case in the OP - it could sound like their email address in DO itself was compromised, when all DO did was check it against HIBP and discovered it was pwned previously probably from another web app...