[mothered]

We use Bcrypt as well.

That's nice to know and certainly good practice.

The security of one's credentials on a given website may not only relate to that site alone, hence If It's compromised and (for example) the same email address and password Is used on other sites, then they'll also be at risk. I've actually come across one victim who used the same login details on more than 20 Individual websites.