You can find the password dumps if you are persistent enough with google and crack the hashes yourself. You can also look into hashes.org. I'd just enforce strong password rules all around in your domain and for the applications you build.
https://haveibeenpwned.com/Passwords
we do enforce password policies that match best practice, just wondering if there is more i could do.