Since everyone's password has been stolen multiple times, the only thing protecting us is there are too many stolen accounts for hackers to exploit all at once.
That is why #infosec professions are recommending that all users must create 5,000,000 accounts for each system they log into and must rotate among them. So 5 mil email accounts, 5 million AWS accounts, 5 million VPN accounts.
Or more password complexity, because hackers will exploit the accounts with easy to type passwords first.