For instance, you can make a list of the top 100,000 passwords, plus another 1000-per-user variations (based on username or email or whatever). Now run them aga

For instance, you can make a list of the top 100,000 passwords, plus another 1000-per-user variations (based on username or email or whatever). Now run them against all users. You'll get some successes, and now those users are at risk. A password DB breach, salted or not, allows an offline, non-rate-limited, attack on those passwords.