I think it may be worth pointing out that despite the terminology employed by many of these companies in the WordPress security space, these technically aren’t “brute force” attacks. They are dictionary attacks of some form, which only target weak, commonly-used passwords. This is evidenced by the low volume of attempts from each of the pwned devices. A brute force attack would be an attempt to run every single possible password combination, up to a certain number of characters in length. This requires an unimaginably enormous volume of attempts, and as such, it is seldom, if ever, employed on the web. The time and resources needed to mount such an attack would not be worth it, at least not for attacks on random websites, only possibly in a targeted attack on a particular person/business/site. It is much easier just to run a dictionary attack with a few of the most common username/password combinations. Avoiding having your site exploited via a dictionary attack is as simple as using a strong password, and ideally also not using the “admin” username. Of course, raising awareness about insecure routers is certainly a good thing. It is sad to say that many routers are insecure and require maintenance on the part of average internet users, who have no idea about it. I’m thinking of purchasing a new router in the near future myself, and I’m hesitant to know which one to choose.