It used to be that I wasn't surprised when my password app would tell me an account is compromised.

Now I'm surprised, often. Accounts with good generated passwords I get warnings about.

Not that that vendor or site ever tells me they were hacked, but it's one of those cases where I can't imagine how else it ended up on a list somewhere ...