A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is the "brute-force" method but most sites will simply lock the account, when there are too many false tries. So how get hackers access to the account?
Brute Force Options:
Credential Spraying (distributed brute force): try the same password on multiple accounts or multiple systems (or variations on this theme). No one account is getting focus, so the attack on each account goes under the radar.
Offline Brute Force: use a weakness in the system to extract the password database that contains the (hopefully) hashed passwords. Take all the time you want to crack each hash (or the hash of the account you want).
Online Brute Force: public sites don't lock the account when there are too many tries. They might block the IP of the source of the failures, but then the attacker can change IPs. It's possible to slow attacks down to stay under the settings of the automated protection mechanisms.
Password reuse: look up a database of breached credentials and try that combination on popular services. It's effectively one try per service. For accounts that show up multiple times, use the collection of passwords used.
Authentication weaknesses: flaws in the system might allow the attacker to gain access to other accounts or parts of the information that should only be accessible to the authorised account. This is pretty rare and a highly specific problem.
Phishing: just ask the person for their credentials
Help Desk Hacking: use weak password reset processes or the online support desk to get the service to grant the attacker access to the account