I suspect that some antivirus programs are simply checking passwords against a list of known compromised passwords, probably the one at 'have I been pawned' (HIBP).
https://haveibeenpwned.com/Passwords

It means that password has appeared in a data breach. I doesn't mean anybody knows that password goes with a particular email address or that it's used by Mudcat. Unless Mudcat itself has been breached - which it might have been - but I doubt it because, well, who would bother?

If most Mudcat passwords are like mine - 4 letters and it's in the dictionary - then I expect they're in the HIBP database. Mine is - 176 times!

AV programs like justifying their existance by finding something to warn you about.

But - serious point - don't use the same password on several sites.