This question already has an answer here:
It's common practice in many system to keep a password history for different reasons (mainly, prevent the user from reusing them).
Answers like this one suggest that they are usually kept on the same format (which makes sense, in order to easily check it on password change).
Answers like this one suggest that they are often kept in the same database system.
So this makes me wonder: Doesn't this make a breach in the database all that much worse, since an attacker would have multiple passwords associated to that user/email which they can try to login in other systems (since a lot of people have 3-4 passwords that they reuse)?
Alternatively, if you have a mental algorithm for passwords, it could be deducted (not sure if anyone would bother, but for a high profile account, maybe) from the multiple samples.
Is there actually additional risk? Is this risk a concern? In which case, are there best practices to mitigate it?