I saw an interesting video, where they were breaking hash tables using gaming GPUs. Basically, the greatest flaw is the users. Microsoft thinks 8 characters are enough https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements - then when you look at their complexity, you end up realising that Password01 meets their requirements and people use that.
They then just tried all the terrible passwords, using them they reverse the hashing, salting and anything else you throw at it. It is the people using weak passwords …