Credential stuffing: Attackers grab passwords from old breaches, then test them everywhere. A 0.1% hacking success rate may ...