The rotation requirement is possibly misguided but does solve the problem where the passwords were leaked months ago. If everybody affected had rotated password

The rotation requirement is possibly misguided but does solve the problem where the passwords were leaked months ago. If everybody affected had rotated passwords three months later, this problem wouldn't even exist today. Old leaks often show up a long time later. A lot of people had yahoo? email accounts hacked because they used the same linkedin? password, but the leak was from years prior. If yahoo had required rotation, the password list would have been useless by the time it circulated.