you'd compare the hashes in your database with those from the file. The users with a hash contained in the file would be notified. Because the passwords aren't

you'd compare the hashes in your database with those from the file. The users with a hash contained in the file would be notified. Because the passwords aren't salted(stupid), you might get multiple hits for the same hash(for example, for the good old "1234" password), meaning you might end up contacting more users than actually affected. Better safe than sorry.