I have no idea about the percentages. But I've been hit twice. One by a leak from a sizable gaming website, and the other time by gawker. Neither time I gave a shit because thankfully I was smart about my passwords.
There's always a risk, it's not expensive to defend against, so why not?
Those are interesting examples because you didn't lose the passwords, those websites did. So stuffing your password in your wallet, or making sure they were 12 characters long wouldn't do any good.
There's always a risk, it's not expensive to defend against, so why not?