I had three emails from HIBP today, for 3 different breaches: Disqus, Kickstarter and Bitly. Three, in a day. These breaches are all years old and at least one of them was set to one of my old passwords I reused in a lot of places (before moving to a pwd manager), so it could have done some real damage. The fact that it didn't happen, makes me think that salted hashing did what it was supposed to do, discouraging bruteforce decryption just enough.

Still, the state of the industry is pretty shocking. We are doing more and more stuff (super-encryption at rest, constant password rotation, password managers etc) and still breaches happen with regularity. It feels a bit like when Office started having a system to recover documents after a crash - yeah, great, but why is the crash happening so often that we need it in the first place?

And I learned it from your comment. Just tried haveibeen and confirmed disqus leak. No emails from disqus!

I got an email too. The thing is, I don't have a Disqus account. The only mention of Disqus in my gmail account is the haveibeenpwned email. Any idea what's going on?

Big thank you to Troy Hunt for this service, I just got my email too.

I read your comment just after you posted it and thought, "oh I haven't gotten an email yet, I must be safe". . 50 minutes later it came through :-p