How seriously should I take Google's darkweb scan results?

Ran it for the first time today and am very shocked to see that my card details, and old passwords were there. I understand that my password could've been found while brute forcing, or maybe from using the same passwords.

Anyways, how seriously should I take this? As Google already has these details, it might be simply provoking me to buy a Google One membership, as it offers automated periodic scans as such.

What do you think? In how serious …

brute brute forcing card darkweb found google old password passwords privacy results scan today understand