If people are finding their unique password's hashes in the database, that's pretty damning evidence that a security breach has occurred.