Add "Force password reset on compromised password" option This option is likely overkill for most sites and is not generally recommended