My first guess was that by publishing the file-name, it is easier to link a compromised email to a password. I'd guess that, if you had access to the dumps, thi

My first guess was that by publishing the file-name, it is easier to link a compromised email to a password. I'd guess that, if you had access to the dumps, this functionality would be about a 10-20x speedup to lookups of the password belonging to an email. However, I think the real reason is privacy. If I recall correctly, there are certain breaches where HIBP redacts the website to protect privacy. A great example of this was ashleymadison. It kinda sucks when anyone that knows your email can learn you were on that site. It seems excessively hard to screen the entire list of 2800 items for such privacy concerns.