Credential stuffing
Also known as: credential-stuffing attack, password stuffing, credential stuffing attack
Credential stuffing is an attack where criminals take huge lists of usernames and passwords leaked from previous data breaches and automatically try them on other websites, betting that people reused the same password.
Even a tiny success rate yields thousands of hijacked accounts. While credential stuffing exploits a human habit, it's largely defeated by unique passwords, multi-factor authentication, and websites detecting automated login attempts.
Credential stuffing, explained at three levels
At home
If you use the same password everywhere, and one site gets hacked, criminals will try that password on your email, bank, and shopping accounts. That's credential stuffing.
At work
Credential stuffing leads to customer account takeovers, fraud, and support costs, even when your own systems were never breached.
At home
Criminals use software to try millions of leaked logins automatically. Using a unique password for every site, stored in a password manager, makes leaked passwords useless elsewhere.
At work
Attacks use bots, proxies, and residential IP addresses to avoid rate limits. Defences include MFA, bot detection, checking new passwords against known breaches, login anomaly detection, and rate limiting by account and device.
At home
Services like Have I Been Pwned let you check whether your email appeared in a breach. In my opinion, it's worth checking once, then switching to unique passwords for any site that shows up.
At work
Privacy regulators increasingly expect organizations to defend against credential stuffing as a foreseeable risk. Monitor failed login spikes, require MFA for sensitive actions, offer passkeys, and have a plan to force resets and notify affected customers.
Real-world examples
At home
Fatima got an email saying someone signed into her food delivery account from another city. She had reused an old password leaked in a breach years earlier.
At work
Carlos manages security for a Canadian online retailer. After a wave of credential stuffing, he added bot protection and mandatory checks against breached passwords, and account takeovers dropped sharply.
How it compares
| feature | Credential stuffing | Brute-force attack |
|---|---|---|
| Passwords tried | Real leaked username-password pairs | Guessed passwords |
| Success driver | Password reuse | Weak passwords |
| Attempts per account | Few | Many |
| Best defence | Unique passwords and MFA | Strong passwords and lockouts |
Stuffing reuses real passwords. Brute force guesses new ones.
For analysts
If you run customer accounts, I'd check new passwords against breach lists and offer MFA or passkeys. It's far cheaper than handling waves of account takeovers.
History & origin
As massive breaches leaked billions of passwords from the 2010s onward, including Yahoo, LinkedIn, and many others, attackers began automating login attempts using those lists. The term 'credential stuffing' became common around 2011 to 2014. In August 2020, attackers used credential stuffing against Canada Revenue Agency accounts and the federal GCKey sign-in service, compromising thousands of accounts and leading to fraudulent benefit claims; the government temporarily shut down online services. In October 2023, 23andMe disclosed that credential stuffing on about 14,000 accounts let attackers access information on millions of users through its DNA Relatives feature, and privacy regulators, including Canada's Privacy Commissioner, later investigated. In my view, password reuse is the single most common security mistake people make, and credential stuffing is how criminals cash in on it.