I'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / mas

I'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / master password practices—which are indeed, not good, but also not fully understood exactly how they did it—are also not evidence that the masters have been compromised. Again, that it could be an attack vector is interesting and relevant, but different from "has been breached" per OP.