You do not need to be “targeted” to lose an account to a weak password. Most break-ins are automated and rely on two simple facts: people pick predictable passwords, and people reuse them.

How the attacks work (at a glance)

• Credential stuffing. When any website gets breached, the leaked email-and-password pairs end up on public lists. Attackers simply try those same pairs on other sites. If you reused a password, one old breach unlocks your game, email and Discord at once.
• Guessing common passwords. Automated tools run through huge lists of the most common passwords first (123456, password, a name plus a year). Anything on those lists falls in seconds.

What actually protects you

• A different password for every account. This is the single biggest win – one breach can no longer spread.
• Length over cleverness. A long passphrase of a few random words beats a short “complex” one.
• A password manager so unique, long passwords are actually practical.
• 2FA so that even a leaked password is not enough on its own.
• Check haveibeenpwned.com to see if an address of yours appeared in a known breach.