Hackers take credentials leaked from other websites (like old social media or forum leaks) and compile them.