Credential stuffing
Attackers try usernames and passwords leaked from one breach against many other sites, betting people reused the same password.
For small firms
A password manager with unique passwords per site neutralizes this attack completely.