It is the same headline as the "Did Disney+ get hacked?" stuff the other day. 10m+ credentials were available almost immediately because people re-use username/password combos across every site.

That's why I am pro-password managers. Even if they're imperfect, password re-use remains a major active threat (contrast that with a lot of theoreticals against password managers).

Around ten of my accounts' information has been leaked (inc. big ones like Adobe). But I don't re-use credentials so aside from an uptake in spam, it has had no impact. Typically these were services I haven't used in years.

Why is Ring allowing brute forcing? Individual cameras should be set to only allow logins at least a few seconds apart increasing up to several minutes and perhaps blocking IP addresses with excessive volume. If they're brute forcing Ring's servers an application firewall would catch and block this.

The term for this type of attack is credential stuffing.

https://www.owasp.org/index.php/Credential_stuffing

This comment shouldn't be downvoted. This is the correct term.

I don't think that the above comment means brute-forcing in the "try a million different passwords in a short time-period" sense, it's referring to finding a list of known password and email combinations and trying just those. I would expect that a few attempts wouldn't trip any brute-force alarms.

Especially if you use a few thousand proxies.

Not actually brute forcing individual ring accounts. They are just using previously leaked combinations