Salting is irrelevant to making such a statement. For instance, some users probably have their password set to "zomato1234" or "passw0rd" or (anything in the ne

Salting is irrelevant to making such a statement. For instance, some users probably have their password set to "zomato1234" or "passw0rd" or (anything in the next 10000+ most common password patterns). Salted or not, it's very feasible to perform that kind of analysis on the leaked data, find weak passwords, then use them with that user's account on other sites.