Credential stuffing

Credential stuffing uses databases of usernames and passwords stolen from other services. The attacker tests them en masse on more sites, counting on the victim having reused the same password in many places.

That is why it is crucial for every account to have a different, unique password, ideally generated and remembered by a password manager. Two-factor authentication blocks this attack even when a password has leaked.