If you're manually checking the 12 million username password pairs in the leaked database you aren't really going to breach many accounts before people update their passwords, are you?