> they didn't keep hashes, so they could go off and use all the various algos (sha, md5 etc) then see where else those users were members (by looking for password if they were dumb enough), I wonder how often that happens in the corporate world
Oh yeah I know the re-use is common, I more meant the technique of purposefully not hashing or disabling hashing to compare hashes across services and connect users.
https://en.wikipedia.org/wiki/Credential_stuffing
Indeed, it's a major problem.