Hashing is the correct way but big companies commonly do things wrong. If they had a sqli vulnerability in their site without knowing it's also possible that th

Hashing is the correct way but big companies commonly do things wrong. If they had a sqli vulnerability in their site without knowing it's also possible that they didn't even know this database existed.