After breach, users rarely change their passwords – when they do, often weaker (opens in new tab)

The paper shows that only 1/4rd of the passwords are weaker.

Figure 1 of https://www.ieee-security.org/TC/SPW2020/ConPro/papers/bhaga... .

About 50% were of roughly equal strength.