I got hit day before yesterday. Started Saturday afternoon. I started getting email from "Limit Login Attempts". I increased the lockout time. Made no difference and as a matter of fact it was sort of like kicking a yellow jacket nest. I'd uninstalled Jetpack as I am in the middle of a divorce and it was just too much minutia for me right now. By night before last there were 260 + attempted failed logins and I'd locked the IPs out for 8 hours each but they started coming with new hits about every 4 minutes. Not knowing that Jetpack for WordPress could protect against this or what a Brute Force Login Attack was... I went looking for security and installed All in One Security and Firewall plugin (free). I am not here to promote this software... just saw the topic. I contacted my Web Host and I was up to date with all I needed to do. He made a really simple suggestion of adding CAPCHA to the login. It was an elegant solution in it's simplicity. Made that change and it got very quiet. Sweet. The web host did say that there is a concentrated effort on now by hackers singling out WordPress blogs. Today in the wee hours I had two failed attempts - no more. I have no ill will toward anyone but 99% of this activity was coming from the Russian Federation with the IPs pretty much in sequence. With the site locked down - all of the locked out IPs are now re-enabled and the swarm has flown elsewhere. Good luck!!! And from what I'm reading... I will reinstall Jetpack...