In addition to plaintext data breaches, there are also the risks of Phishing (if one password can open many accounts) and a malicious website owner just deciding to harvest user/password combos on his own signup script.