Sounds like it's not brute forcing simple using the same email/password for some random site that then gets compromised, malicious actors then try those same credentials to log into Ring and they're in first try