A credential stuffing attack is one of the most effective ways to take control of accounts. Here’s how it works and what you should do to protect your company.