There are a lot of ways, a database with passwords can end up in unwanted hands. If the passwords are not securely hashed then, the owner of the webiste is responsible and in much trouble, because often the users reuse their passwords on other sites as well. I would like to give you some examples, how a database can leak:
- SQL-injection is an easy attack against your website. I made a small demo to show how easy it is. Just click on the next-arrow to get malicious input. SQL-injection can be dealt with, writing clean code, but often you use third party libraries or haven't developed the source code alone, then unsafe code could have slipped through.
- If you are hosting your website by an external provider, at least the staff of the hosting company have free access to the database. Often other people have access as well, maybe you need a developer, to fix a certain problem or to extend your page.
- Backups are a problem too. If Backups are not stored with the same care as the running server is secured, or if they are thrown away without erasing them properly, the passwords are leaking.
- If a server is discarded, it must be cleaned before disposing it. In case of external hosting, this is not under your control. Cleaning can be quite difficult on raid systems.
- More and more data is stored in cloud services. A handy thing these clouds, but is also cloudy where your database ends up, and properly cleaning in a cloud may be even impossible.