What Is Credential Stuffing

The attack that turns old breaches into new threats

Credential stuffing is an automated attack in which stolen username and password combinations from one data breach are systematically tested against other websites. The name describes exactly what happens: an attacker "stuffs" a site's login page with credentials harvested from a previous compromise, hoping the same combination works elsewhere.

This works because of password reuse. When someone uses the same email and password for their bank as for a forum that was breached five years ago, both accounts are compromised the moment the forum's database leaks. The attacker never needs to target the bank directly — the breach of a less secure site does the work for them.

The scale: billions of credentials in circulation

Have I Been Pwned (haveibeenpwned.com), the public breach monitoring service, contains more than 17 billion compromised email addresses as of 2026, from over a thousand breached websites. The RockYou2024 compilation contains nearly 10 billion unique plaintext passwords, many of them recycled from earlier leaks. These datasets are freely distributed in underground forums and regularly updated as new breaches occur. The supply of compromised credentials has never been larger, and it grows with every new breach.

How a credential stuffing attack runs

A typical attack: an attacker downloads a credential list. They configure an automated tool (commonly OpenBullet or SilverBullet) with site-specific "configs" that know how to submit each site's login form and detect success or failure. The tool fires requests at the login endpoint, rotates through IP addresses via residential proxy networks (to avoid IP-based blocking), introduces delays to mimic human behavior, and flags successful logins for manual review. Professional actors run these campaigns at scale, testing very large numbers of credentials against many target sites at once.

Commonly cited estimates put success rates at roughly 0.2–2%. Against a list of 10 million credentials, that would be 20,000–200,000 compromised accounts per campaign. For financial accounts, each successful login has direct monetary value.

Why you cannot rely on companies to stop it

Companies deploy defences: rate limiting, account lockout, bot detection, CAPTCHA challenges, anomaly detection. These raise the cost and slow credential stuffing campaigns. They do not stop them. Attackers adapt: they slow their request rate to stay below rate limits, use residential proxies that look like legitimate user traffic, use commercial CAPTCHA-solving services, and rotate accounts to stay below lockout thresholds. Bot detection services (Cloudflare, Akamai, Imperva) help but add cost that many smaller sites do not absorb. The attacker has every incentive to keep trying; companies have limited resources to stop them.

The three-step complete defence

Credential stuffing collapses entirely if you eliminate password reuse. The full defence is three steps.

Step 1: Unique password for every account. This is the single most important change. If Site A is breached and your password there is recovered, it cannot be used anywhere else because no other site has that password. Use a password generator for each new account, save the password in a manager, and never reuse it. A breached password becomes a credential useful only for the site it was breached from.

Step 2: Multi-factor authentication on every account that offers it. Even if an attacker has your exact username and password, MFA blocks most such attempts at the second factor. Prioritise email (the master key), financial, and social media accounts. TOTP authenticator apps (Google Authenticator, Authy, Aegis) are more secure than SMS. Hardware keys are more secure than TOTP. Any MFA is dramatically better than none.

Step 3: Monitor for your own breaches. Visit haveibeenpwned.com and enter your email address. If it appears in known breaches, change the password on every account that used the breached password — immediately. Sign up for breach notifications so you are alerted when your address appears in future leaks. The site is free and maintained by security researcher Troy Hunt.

What happens when you complete all three steps

Credential stuffing becomes irrelevant for your accounts. An attacker can test a thousand breached username/password combinations against your accounts and none will work — because each of your accounts has a unique password that was not in any breach. If a site you use is breached in the future, the leaked password is useless for credential stuffing because it is unique to that site. MFA means that even if somehow your exact credentials for one site are obtained, the attacker still needs the second factor to log in. Monitoring means you find out about any breach that involves your email address and can respond before an attacker does. Together, these three steps make credential stuffing attacks against your accounts computationally pointless.