I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a salted SHA-256 (presumably the other HMAC inputs are being stored separately for bonus security).
The security developers speak a different language so it's basically impossible to communicate with them directly, or determine exactly the requirements. I went straight to the higher-ups who only seem to understand business case studies. I've been told amid my protestations that basically the only way to convince them would be to find some real-world examples of major password leaks that used both a salt and HMAC but not iterative strengthening, and had many passwords compromised as a result.
Please understand I'm not going to try to attain the impossible and get them to implement the exact standard recommendations for password storage. I just want them to consider iterative strengthening.
Are there any prominent real-world examples where salt and HMAC were used, but due to lack of iterative strengthening, many passwords were compromised anyway? Bonus points for well-known companies such as Facebook, LinkedIn, etc.