Just for kicks, I recently entered my email in HaveIBeenPwned, figuring that there have been enough data breaches in enough places over the years that it would probably turn up something just by the law of averages. And I saw something very strange: it reported my email address had been found in a data breach on a site I never signed up for!
How does something like that end up happening, and how seriously should I take it?