"Use strong and unique passwords" is a good practice, but it's not really actionable in response to these breaches. How many normies without password managers

"Use strong and unique passwords" is a good practice, but it's not really actionable in response to these breaches. How many normies without password managers remember every site where they created an account in the last five years? Even if they start using strong and unique passwords now, they won't go back and change passwords in services they've forgotten. All I know from Cit0Day is that my account was breached in one or more of 23000+ sites. I can't tell which one(s), so it's not actionable. Troy runs haveibeenpwned as a free public service, so it's not right to ask him to do more than he already has. But to be actionable, each email in the Cit0Day dump could be associated to the individual sites so users would know where they'd been pwned.