While everyone and their favorite webcomic seems to agree that password reuse is a major problem, some quick googling cannot seem to find any cases where it has been used on a large scale in an attack. Thus I ask, has there actually been any occurrences of a large-scale breach made possible by password reuse? If not, why hasn't there been any?
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The attack against HBGary is a famous example of an attack made easier by password reuse:
Neither Aaron nor Ted followed best practices. Instead, they used the same password in a whole bunch of different places, including e-mail, Twitter accounts, and LinkedIn. For both men, the passwords allowed retrieval of e-mail. However, that was not all they revealed. Let's start with Ted's password first. ... his ssh password was identical to the cracked password he used in the CMS. This gave the hackers immediate access to the support machine.
I don't know if you consider this attack large-scale, but it was definitely large impact to compromise a famous security firm, publish its internal emails etc.
Recently there has been the case of the Cardinals being Investigated for Hacking Into Astros’ Database.
Investigators believe that Cardinals personnel, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials when they worked for the Cardinals. The Cardinals employees are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said.
That tactic is often used by cybercriminals, who sell passwords from one breach on the underground market, where others buy them and test them on other websites, including banking and brokerage services. The breach on the Astros would be one of the first known instances of a corporate competitor using the tactic against a rival. It is also, security experts say, just one more reason people are advised not to use the same passwords across different sites and services.