I prefer to call them "online password guessing attacks" since "brute force" has a specific meaning that may not always apply to these attacks. But yes, they do still happen and here are a few example stats for you:
Microsoft: “we detect more than 10 million credential attacks every day across our identity systems.”
Akamai: They observed “999,980 IPs were involved in the attacks against [a financial institution] customer's login page.” 427 million accounts were checked in a one week period. Also saw 817,390 IPs making 388 million login attempts using 65 million email addresses against an entertainment industry customer. Comparing source IPs of both attacks, they found 70% match, implying the same org was responsible for both attacks, or that they used the same botnet.
Google: “We’ve seen a single attacker using stolen passwords to attempt to break into a million different Google accounts every single day, for weeks at a time. A different gang attempted sign-ins at a rate of more than 100 accounts per second.” This was reported in 2013, but I'm sure they still face similar attacks.
Taobao: Taobao was attacked via an online guessing attack over a few days in Oct 2015. The attackers used 99M credentials collected from other sites. 20.5 million credentials matched Taobao accounts, which was about 1 in 20 of their total annual active buyers. Wasn’t detected until November, however Alibaba says at the time their security systems discovered and blocked the vast majority of log-in attempts. Still resulted in around $1 million of fraud transactions on their site.
In these cases these sites may have rate limiting or other adaptive authentication controls in place, but they aren't 100% effective in preventing all account takeover attempts.