Credential-stuffing attacks, while seemingly inefficient, have a success rate between 0.2% and 2.0%, which makes them highly profitable as hackers test millions of credentials to yield thousands of compromised accounts.