Credential stuffing

What it means

Credential stuffing is an attack in which usernames and passwords stolen in a data breach are tried on other sites. It relies on people reusing the same password, so a password leaked from a forum often also opens an e-mail account or a company system.

Unlike a brute-force attack, passwords are not guessed; ready-made username and password pairs from large lists are tested. The attack is automated, often run through a botnet with thousands of IP addresses so that simple attempt limits do not catch it.

The success rate is low, but across millions of attempts a small percentage is enough. For a business the most dangerous targets are e-mail, online banking, accounting software and online shops, where an attacker can change bank details on invoices or misuse stored cards.

How it works in practice

The best defence is a unique password for every service, which in practice only a password manager makes possible. A company password policy should ban reuse and teach staff never to use a work password for personal services.

Two-factor authentication stops the attack even when the password is correct, because the attacker lacks the second factor. Passkeys are more resilient still: they replace the password entirely and cannot be used on a fake site.

Site operators defend themselves by monitoring unusual login attempts, adding a CAPTCHA for suspicious patterns and checking passwords against known breach lists. When an account takeover is suspected, they should end the session and ask the user to change the password.

What to watch out for

If an attacker gains access to an account holding customer data, it may be a personal data breach that must be reported to the authority within 72 hours. A business should decide in advance who assesses incidents and how customers will be informed.

A common mistake is relying on password complexity. Even a very long password does not help if the attacker already has it from another breach. Uniqueness and a second factor matter, not forced changes every 90 days, which tend to produce predictable variants.