Given that Troy is quite knowledgeable about how breaches happen, if HIBP does get breached, it will likely be due to targeted hacking rather than negligence.