The credential stuffing angle here is worth highlighting - the breach happened because users reused passwords from other breached sites. What's frustrating is

The credential stuffing angle here is worth highlighting - the breach happened because users reused passwords from other breached sites. What's frustrating is that even security-conscious users face a massive burden after any breach: changing passwords across dozens or hundreds of accounts. Research shows the average remediation gap after breach disclosure is 94 days - most people simply don't do it because it's too tedious. We've solved password generation and storage. What's still broken is the actual process of updating passwords at scale when you need to respond to a breach like this one.