They do that, with the extra step of allowing k-anonimity (https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...)