Use the haveibeenpwned.com API to check the user emails and/or passwords have not been part of a breach.

Note: This will require setting up an intermediary API endpoint, since not possible to hide the HIBP key in the plugin.

troyhunt.com/authentication-and-the-have-i-been-pwned-api/