Comment by haswell

The risk is not in sifting through billions of records.

The risk is enabling a service that unlocks a capability like “give me the password for this email address that may or may not be mine”.

The source of a breach is a single attribute that can be associated with an entire dataset, unlike passwords.