Credential-stuffing attacks against online accounts are still popular, and they work thanks to continuing password reuse.