You'll notice that the person that built have I been pwnd has been extremely careful in how the data comes into their possession, I highly doubt they would ever go so far as to breach a site themselves. It would go completely against their mission to do so.

> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.

I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.