One challenge when trying to assess the specific impact that poorly chosen passwords have is that we don't always know how an attacker obtained a password. Maybe the password was learned because it was an easy guess, or it was reused and leaked from another breached site, or was it phished, or a few other possibilities. Either the targeted user or system owners don't actually know the answer to that question, or they know and it simply isn't included in the information shared with the public.
A decade ago I used to actively record stories about password related incidents and looking back through my index there weren't many with details on how the compromised passwords were obtained. For example, here's one story that mentions a student guessing his teacher's password in an hour. Another report disclosed that a woman's ATM PIN was guessed because it was her birth date, which was stored alongside her stolen bank card. But for the few of those with details you'll see dozens of other stories with no mention of how passwords were stolen. As @Matthew points out in his comment these attacks tend to be more individual focused, which often isn't considered newsworthy.
Fortunately we do have a bit more data that we can turn to. In the 2016 Trustwave Global Security Report they reported that weak passwords were responsible for 7% of the hundreds of incidents they investigated the previous year. They don't define what they mean by "weak", but it's reasonable to assume this means a password that can be guessed or cracked within a few minutes to a weeks worth of effort. Or it was a default vendor password. Similarly, they reported weak passwords as the identified method of intrusion 28% of the time in 2015 and 31% in 2014.
RSA shared news of a situation where a attackers tried a single popular password against a site's 145,000 users and successfully compromised 434 of the accounts.
These days some organizations have moved to blacklisting weaker passwords because they are tired of dealing with customer compromises that result from attackers successfully guessing them. Microsoft announced that they were banning common passwords for their customer accounts last year. They joined organizations like GitHub and ArenaNet who have been doing this for years.