Credential stuffing

Credential stuffing is when attackers take usernames and passwords leaked from one site and automatically try them on many other sites.

Bots can test leaked logins against many sites quickly. Every account where you reused that password falls.

It works because many people reuse passwords. The attacker doesn't need to crack anything: the password is already known.

Use a unique password for every account, ideally with a password manager, and turn on MFA so a correct password alone isn't enough.