I didn't see anything when I slipped and fell into the database

from here and here

A quick check of Have I Been Pwned indicates that yes, SHA1 is still being used. 

I didn't think it would be worth it to look for MD5 at first, I was so sure the age of MD5 was over and I would have had to look for a while to find an example, but nope, there was a breach using MD5 added at the beginning of this year. I didn't have to look far at all.

No one seems to be breaking that one anymore

from here

I'm just going to put this out there - some developers are going to see the headlines about SHA1 and shy away from it, but one of the easy alternatives to SHA1 is MD5 and without headlines telling them not to use that one either guess what's going to happen...

Best practice meets worst practice

from here

For all the good XKCD did in teaching people to use passphrases, they went and cancelled it out by using MD5 to hash them with. MD5 has been deprecated for over 20 years, and it was never good for passwords.

Thanks to Have I Been Pwned for raising awareness of both the breach and the bad practice.