Password has appeared in a data leak
Is the password compromised message that pops up on iPhone and iPad legit?
Question marked as
Top-ranking reply
Yes. Apple, Google, Microsoft and other ISPs monitor the “dark web” where hackers hang out, and download lists of compromised data from commercial accounts that have been hacked. They then compare your passwords to passwords on these hacked lists, and if a password has a match you get that message.
You can also check for yourself at https://haveibeenpwned.com, a public service that also collects information found on the dark web.