Credential stuffing is an automated attack in which criminals try huge lists of stolen usernames and passwords on other websites, betting that people reuse the same password.
How credential stuffing works
Attackers take logins leaked in data breaches or harvested by infostealers, merge them into “combolists” with millions of entries and feed them into automated tools. Requests are spread across botnets and residential proxies so that each IP address sends only a few attempts. Every successful login is recorded and later sold, used for fraud or turned into further attacks.
Unlike brute force, credential stuffing does not guess passwords – it replays real ones. Even a success rate of a fraction of a percent yields thousands of hijacked accounts from a large list.
Why credential stuffing matters for security
It is one of the main causes of account takeover in online shops, streaming services, gaming, banking and corporate portals. In 2023 attackers used recycled passwords to log into about 14,000 23andMe accounts and, through a relatives feature, exposed data of millions of users. Stolen accounts are used to buy goods with saved cards, drain loyalty points, send spam and phishing from trusted profiles, or enter company networks.
How to defend
- Users: use a unique password for every service (a password manager helps) and enable two-factor authentication or passkeys.
- Check your addresses in breach notification services such as Have I Been Pwned.
- Websites: require MFA, rate-limit and fingerprint login attempts, use bot detection and check new passwords against known breached lists.
- Alert users about logins from new devices and locations.
