> they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for passwo

> they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing Indeed, it's a major problem.