Definition
After a breach, username and password combinations are sold and then replayed at scale. Automated tools submit those pairs to other login pages: a content management system, a hosting panel, an FTP account, or a game backend. A pair that was reused on the second site succeeds, and the attacker then has that account.
Relevance
A reused password on the studio site, the press portal, or an admin API lets someone else sign in. A unique password per service, and a second factor on admin logins, stops a pair from an old breach from opening the account.
Example
A breach dump contains the password an employee also used for the company WordPress login. A stuffing tool tries that pair against the CMS. The login works, and the attacker can edit the pages the studio publishes.