its combined and aggregated somewhere and then bad actors will try to break into your accounts using that information.

Your email from one site, password from another, geoIP, profile picture, etc.

Best practice is use a password manager w a diff pass on each site, use 2fac where you can