Credential Stuffing
An automated attack that uses leaked username and password pairs from one breach to attempt access to other services, exploiting widespread password reuse.
What Is Credential Stuffing?
Credential stuffing is a type of cyberattack where stolen username/password pairs — obtained from previous data breaches — are systematically tested against other websites and services using automated tools. The attack exploits a simple human behaviour: reusing the same password across multiple accounts.
When a database of credentials is breached at one service, attackers feed those credentials into automated bots that try them against hundreds of other popular services. Even a 1% success rate across millions of credentials yields thousands of compromised accounts.
Why It's So Effective
Password reuse is endemic. Studies suggest that over 60% of people reuse passwords across sites. When an organisation suffers a breach and credentials leak — often sold or shared on the dark web — attackers know those same credentials will work elsewhere.
Billions of credential pairs are available on the dark web today, sourced from years of cumulative breaches (LinkedIn, Adobe, Dropbox, and countless others).
How Credential Stuffing Differs from Brute Force
- Brute force: Tries all possible password combinations for a single account
- Credential stuffing: Uses real, known username/password pairs across many accounts
Credential stuffing is faster and more targeted — it doesn't need to guess, just verify.
How to Defend Against Credential Stuffing
For users:
- Use a unique password for every account — a password manager makes this practical
- Enable MFA on every account that supports it
- Check if your credentials have been exposed at haveibeenpwned.com
For organisations:
- Enforce MFA organisation-wide — this neutralises most credential stuffing attacks
- Implement rate limiting and CAPTCHA on login pages
- Monitor for unusual login patterns (multiple accounts from same IP, logins from new geographies)
- Check employee credentials against breach databases using services like HaveIBeenPwned API
- Enforce password manager adoption — makes unique passwords the default
Password managers are the most practical solution to credential stuffing because they eliminate the password reuse that makes the attack possible.