@Gargron have you asked the Mozilla folks about the work they're doing in that space? They may have some ideas for you.

@Gargron

Maybe keep the timestamp of the last login and if more than (e.g.) two months send a warning email the next time someone logs in?

Or suspend the account and require the user click a link on an email to reactivate.

@Gargron Including passwords seems overkill. Mozilla has a similar service to alert for email addresses in breached services. Maybe they have an API.

@Gargron a simple way to do this, could be to check for old popular domains, like caramail.com , aol.com, hotmail.com, yahoo.com, msn.com and so on. at these jurassic times, people never had incentives to build strong passwords, and from now on they have not be warned about how insecure it is to use the same 6 alphanums on all their accounts.

so for some domains, a warn is always welcome :D

@Gargron
What can happen if you do not do such a scan?

@Gargron I don't think it's necessary. You could send a direct message to all users 1 time a week warning them to check their emails in monitor.firefox.com or haveibeenpwned.com

@Gargron You could ask Kaniini

@Gargron Bypass their database altogether: When someone signs up, before hashing the password simply go the email/username/password combination on all the sites haveibeenpwned covers. It's the perfect plan, and there is no way it could possibly go wrong.

@Gargron I think the best you can do is to check when a user changes their password. Or maybe after X logins the password is checked against HIBP.

That's the only time you have the plaintext password.

@Gargron 1) Find Passwordlists in web (e.g. https://github.com/danielmiessler/SecLists)
2) hash those with bCrypt
3) compare them to the hashes in your db
4) ???
5) profit

@Gargron Unfortunately I think most of these strats won't work, because Devise salts passwords by default and you'd have to hash every password for every user =\

Can someone confirm this?

@Gargron ideally it's impossible w/o the full dataset. Also even if you trust such services, not every user may want you to send password related data to 3rd party APIs.