Not necessarily. It's common practice for a hacker to break into a site, grab the passwords, then sell them or release them on the dark web.

The methods they used to break into the site are often considered "trade secrets".