I think his pie chart drives us to an incorrect conclusion here. It's not that people haven't changed their compromised passwords. The problem is actually that

I think his pie chart drives us to an incorrect conclusion here. It's not that people haven't changed their compromised passwords. The problem is actually that people choose inane passwords, like "password" and "123456". When people are doing that, you're bound to see significant overlap between the two sets.