A friend tells me he was emailed by https://haveibeenpwned.com/, letting him know his details were at that link.