To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is

To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement? Is it even a breach at all, in that scenario? How is Instacart at fault? Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?