It's not uncommon for cybercriminals to combine multiple data sets in order to increase their chances of finding valid user credentials. Security researcher Troy Hunt found the mother of all collections, dubbed "Collection #1". This roll up contains 773M sets of credentials from various breaches.

But why does this work for cybercriminals? Is it an effective technique?