One of my breaches was just Google Chrome (back when I used it) logging me entering my password in a self-hosted local web app via https but with no cert… Google. My breach was Google.