1. A computer implemented method comprising: receiving a list of login credentials for a plurality of users, the list comprising a plurality of user account identifiers, each user account identifier being associated with a password, the login credentials on the list being known to have been compromised due to the list of login credentials having been obtained by a malicious party; receiving first login information submitted from a client device in connection with an attempt to login to an online system, the login information including a submitted user account identifier and a submitted password; determining whether the received first login information matches login credentials on the list of known compromised login credentials; responsive to the received first login information matching any of the known compromised login credentials on the list, identifying a source location from which the first login information was received, and determining that the source location may be suspicious since the first login information is on the list, however the attempt to login could be a valid attempt by a valid user who is an owner of the first login information; receiving second login information submitted from a client device in connection with an attempt to login to an online system, the second login information being different from the first login information; responsive to the received second login information matching any of the login credentials on the list of known compromised login credentials, identifying a source location from which the second login information was received, determining that the source location from which the second login information was received is the same as the source location from which the first login information was received, based on the determination, requiring a security challenge associated with the attempt to login to the online system with the second login information, and based on a failure to meet the security challenge, denying the attempt to login to the online system with the second login information; and denying login for each subsequent login attempt from the same source location, including denying login attempts with login information that is not on the list of known compromised login credentials.