11
It depends. There is not enough information in your question to give specific answers, and probably without knowing the server side, it will be hard to evaluate.
Isn't this a breach?
I would not call it a breach just yet, because simply knowing the fact that the client hashes the password does ...