One Control This Quarter

Lock an account after five consecutive failed attempts and email the owner. That caps how many guesses any single account can absorb, which is the quantity the attacker needs.

Screen every new and changed password against a breached-credential corpus and refuse matches. Stuffing runs entirely on credentials already exposed in someone else's breach, so removing those from your user base removes the attack's input rather than raising its cost.

Put a CAPTCHA on the login form. It is the only control that separates a human from a script, it needs no change to the product, and it applies to every attempt regardless of source.

Rate limit the login endpoint to ten attempts per minute per source address. Throughput per address is what makes an attack of this size economical.