Other sites could absolutely spend time crawling for new lists of breached passwords and then hashing and comparing against their own. However this is an intensive process and I'm sure both Facebook and Google have a team dedicated to account security with functions like this.

Ultimately it comes down to how much time and money you can dedicate to keeping your users' accounts secure versus how important it is to do so. Google and Facebook accounts sit at the centre of many users' internet lives and would be devastating to use. Same for most email accounts.

Furthermore, one should also consider that **publishers – a category including natural persons and SMEs – are often the “weaker” party in this context.** Conversely, third parties are usually large companies of substantial economic import that work as a rule with several publishers, so that one publisher may often have to do with a considerable number of third parties.