In what is colourfully termed a ‘brute force’ attack, hackers use bots to test millions of username and password combinations on different websites – until they find a match.