How does apple differentiate between someone else's log in details with the same password as you being leaked? Do i need to worry about these alerts?

I have a question about password data leaks.

I've been getting alerts that my santander security number appears in data leaks, a few times now i've had these alerts- changed it, then thought things were fine and got one a couple weeks later. I've had this account for years now, but have only gotten these alerts in the last couple months

Thing is, the security number santander has you set is only 5 numbers, and i know that no matter what 5 numbers i chose there's probably someone who's data has been leaked who's used that password on something before- so are these alerts i'm getting actually to worry about?

i tested on haveibeenpwned.com and sure enough, typing in the old security code i just changed resulted in me being told it has been on several hundred data leaks. then i tried a password i used to use (that got leaked for sure), only one. then i tried a password i know has not been leaked and it came up with 0.

so, is it just alerting me because someone else's password login details got leaked at some point? or is it alerting me because my specific log in for santander were leaked? should i be worried about the security of my santander account? to log on, they'd also need to know my personal ID which is a longer string of numbers, as well as this security code.

anybody know how i can add more steps to logging into my santander account? even if i don't need to worry about the security number, it would be nice if there was more layers of security.