Given many people use the same password.on many sites, it can allow the bad actor to "guess" their password based on data from other leaks.

Then whatever is inside that account may be accessible, such as financial info. Even protected data like cc info might show the last 4 digits, which can be used when talking to an agent to verify identity etc.