Most accounts created before sometime in 2018 likely have just 5000 iterations and not 100100. Since the iteration count is kept in the clear an attacker would

Most accounts created before sometime in 2018 likely have just 5000 iterations and not 100100. Since the iteration count is kept in the clear an attacker would likely begin with them (with the added benefit of an older account might have more data in it). So the likely steps an attacker in possession of the vaults would take: 1) Find all vaults with the lowest iterations 2) Order by some criteria (known money sources: URLs for banks and crypto, known URLs that would have PII information: utilities, telcos, governmental URLs) 3) Start cracking... Or they could skip all that for some quick money. There's no need to crack anything if the URLs can get you money. How much would a dictatorship pay for the identities of everyone with an account at a URL that posts negative information on the regime? A domain.com/wp-admin account could certainly get you killed.