What is credential stuffing?
Definition
Credential stuffing is an attack where criminals take username and password pairs stolen from one service and automatically try them on other services, hoping the same login works.
- Category
- Attacks
- Also called
- password stuffing
- Last updated
Credential stuffing works because many people reuse passwords. When a site is breached, the leaked email and password pairs end up in lists. Attackers feed those lists into tools that try them, at scale, on banks, shops, streaming services and email providers. Wherever the same pair works, they get in.
The UK National Cyber Security Centre (NCSC) describes the attack as taking advantage of people reusing username and password combinations across accounts. It says the main motivation is financial, but it can also lead to identity theft.
Example: you used the same email and password for a fitness forum and your online shop. The forum is breached years ago. Today an automated tool tries that pair on the shop, it works, and your saved card and address are in reach. You never did anything wrong on the shop's site.
This is different from a brute-force attack, which guesses passwords. Credential stuffing doesn't guess: it replays real logins that already leaked. It is also not phishing, because nobody tricked you into typing anything.
Why it matters: the weak point is a password you reuse, not your newest account. One old breach can unlock many accounts, and you may not notice until money moves or messages go out.
Credential stuffing vs. password spraying
Password spraying tries a few common passwords against many accounts. Credential stuffing uses known email and password pairs from previous breaches.
How to protect yourself
- 1
Use a different password for every account
A password manager makes this realistic. Start with your email, bank and any account that can reset others.
- 2
Turn on two-step verification
A stolen password alone then isn't enough. See two-factor authentication.
- 3
Change passwords that appeared in a breach
If an alert says your email was in a breach, change that password everywhere you used it, not just on the breached site.
- 4
Watch for login alerts
Turn on notifications for new sign-ins and review them when they arrive. Serus monitors breach databases and the dark web and alerts you when your email or passwords appear.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How do I know if I'm a victim of credential stuffing?
Signs include login alerts you didn't trigger, password reset emails you didn't request, or changes to account details. Check recent sign-in activity on important accounts.
Is credential stuffing a hack of the company?
Usually not. The company's systems work as designed. The attacker uses valid logins that leaked elsewhere.
Does two-factor authentication stop credential stuffing?
It stops most of it, because the attacker has the password but not the second step. It's still worth changing reused passwords.
Sources
Something wrong or out of date? Tell us and we'll re-check it.