So I put my e-mail address into https://haveibeenpwned.com/ and it says "Oh no — pwned!". But most of the things listed I've never even heard of, and they look like mostly spam-lists/marketers that could only have ever had e-mail addresses that have been intentionally public for *decades* now (which is probably how they got them in the first place). So I guess that's a big... "whatever"?