So I guess just assume all your passwords are cracked and use a password manager.

Even if it's not in the HIBP base, you should always assume that. That's why you should always enable MFA everywhere it's possible and consider all services where it's not already compromised.