We will just have to disagree. With time, all passwords can be brute forced. If you change them periodically, using a pw manager and/or a strong methodology, then it becomes more expensive to keep brute forcing.
History shows us that sites are popped on a regular basis and their users do not always find out right away. Sometimes the org in question doesn't even know for a while.
History shows us that sites are popped on a regular basis and their users do not always find out right away. Sometimes the org in question doesn't even know for a while.