I don't think that's the most important part. Rather: Full disclosure can also protect previously unaffected / potential future customers, by warning them of c

I don't think that's the most important part. Rather: Full disclosure can also protect previously unaffected / potential future customers, by warning them of companies that have been so lax with their security that they've been breached. So to achieve a comparable upside to full disclosure, HIBP needs to also make aggregate data publicly available. Which they do: https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites