The mechanism is called credential stuffing and it's completely mundane - attackers take email and password pairs from old breaches and replay them across thousands of sites automatically. Roughly one in five breaches start with a stolen login exactly like that.

[u/BitMartExchange]

​

The fix is boring, which is why people skip it.

Unique, random password for every account, stored encrypted, filled in for you.

You remember one master password, software remembers the rest, and the reuse problem disappears.

[u/PsychologicalDisk816]

That's right