We have breach notification requirements, obligations, and we notify our users if there's a suspected breach of their environment and recommend that they change their passwords.
For the enterprise set, like that toolset that I mentioned—“Have I been pwned?”, I think it's called—