Credential Stuffing

Noun · Security & Infosec · Origin: 2011

Definitions

  1. Credential Stuffing is a cyberattack where attackers use large collections of stolen username/password pairs (obtained from previous data breaches) to attempt automated logins against other websites and services, exploiting the widespread habit of password reuse across multiple accounts. Unlike brute force attacks that guess passwords, credential stuffing uses real credentials that have already been compromised elsewhere. Attackers use automated tools and botnets to test millions of credential pairs against target sites, rotating IP addresses and using residential proxies to evade rate limiting and detection. Even a success rate of 0.1-2% across millions of attempts yields thousands of compromised accounts. These accounts can then be used for fraud, data theft, identity theft, or sold on dark web marketplaces. Defenses include multi-factor authentication (the most effective countermeasure), breached password detection (checking if credentials appear in known breach databases), CAPTCHA challenges, device fingerprinting, behavioral analysis, and rate limiting. Services like Have I Been Pwned help users check if their credentials have been compromised.

    In plain English: Hackers take passwords leaked from one website and automatically try them on hundreds of other sites, hoping people used the same password everywhere.

  2. Credential stuffing succeeds because 65% of people reuse passwords across services. The defense trifecta: rate limiting login attempts, requiring multi-factor authentication, and checking passwords against known breach databases (like Have I Been Pwned).

    Example: 'We blocked 2 million credential stuffing attempts last month just by implementing rate limiting and CAPTCHA after 5 failed login attempts from the same IP.'

    Source: defense strategies

Related Terms