What it is
When a third-party service suffers a breach and credentials are dumped to a paste site or criminal marketplace, those credentials get indexed by public breach databases within hours. If an employee reused the same password on the corporate SSO, VPN, or Microsoft 365 tenant, the attacker now has a working set of credentials without any need for phishing.
Why it matters
Password-spray attacks against corporate identity providers use exactly this input: a list of valid usernames (harvested from the target's domain via public-record scrapers) combined with a list of passwords that have appeared in prior breaches. The attacker never triggers a lockout because they test one password at a time across many accounts, and one working credential is enough to open a session.
The check behind the finding
Check each address at your domain in a public breach-notification service, then confirm those passwords were changed.
Closing it
This can be closed, and the order matters: the accounts whose passwords were exposed come first. The assessment lists each address with the breach it came from and gives the exact steps.