Credential Stuffing: Definition, How It Works and Protection

What is Credential Stuffing?

"Credentials" are login data. "Stuffing" means cramming something in. In credential stuffing, attackers cram stolen login data into other sites' login forms on a large scale.

The attack exploits a human weakness: many people use the same password for several services. If an online shop is hacked, the email account, the company portal or the bank account are often at risk too.

How an Attack Works

1. Get login data: attackers buy or download lists of email addresses and passwords from earlier data leaks. Such collections are called combo lists and are passed around in forums and on the dark web.
2. Pick a target: services with value are of interest, such as online shops, streaming accounts, banks or company access such as VPN and email.
3. Test at scale: bots try the pairs in large numbers. They spread the attempts over many IP addresses and copy real browsers so they are not noticed.
4. Use the hits: working accounts are taken over, sold on or used for fraud.

An example: an employee uses the same password for a fitness portal as for their company account. The portal is hacked, and the data ends up in a combo list. Weeks later, a bot logs in to the company's webmail with exactly this data. Without MFA, the attacker is now in the mailbox.

Even a low hit rate pays off for attackers. With millions of pairs tested, enough working accounts are left.

Credential Stuffing, Brute Force and Password Spraying

• Credential stuffing: real, leaked pairs of user names and passwords are tried on other services.
• Brute force: passwords are guessed by trying them one after another.
• Password spraying: a few common passwords are tried on many accounts to avoid account lockouts.

All three attacks have one thing in common: they target the login. The OWASP Top 10 list these weaknesses under "A07:2025 Authentication Failures". Read more under OWASP Top 10.

Impact on Companies and Users

• Account takeover: attackers act in the victim's name, read emails or change data.
• Fraud: orders, transfers or cashing in vouchers and loyalty points.
• A way into the company network: a taken-over company login can be the first step to a larger attack, such as ransomware.
• Data breach: if personal data is accessed, a duty to report under the GDPR can arise.
• Costs and reputation: support work, refunds and lost customer trust.

Detecting Credential Stuffing

Look out for these warning signs in your login logs:

• many failed logins for different accounts in a short time
• login attempts for user names that do not exist on your system
• access from many changing IP addresses, often from data centers or other countries
• unusual times, devices or browser traits
• a sudden rise in password resets and customer complaints

For this, logins must be logged and analyzed in one place. See security logging and monitoring.

Protection Against Credential Stuffing

For Companies and Service Operators

• Multi-factor authentication: the stolen password alone is then no longer enough. Introduce MFA at least for admin accounts and remote access, better for everyone.
• Passkeys: they replace the password with a key pair on the device. There is nothing left that can be leaked and tried elsewhere.
• Block leaked passwords: check new passwords against lists of known leaked passwords. The NIST guideline SP 800-63B recommends this too.
• Limit login attempts: rate limiting and growing delays slow bots down.
• Detect bots: device traits, behavior analysis and, if something looks odd, a CAPTCHA.
• Check unusual logins: ask for extra confirmation for new devices or places and inform the user.
• Watch for your own leaks: if your staff's login data shows up, reset the passwords. See dark web monitoring.

For Users

• Use a separate password for every account
• Use a password manager that creates long, random passwords
• Turn on MFA or passkeys wherever you can
• Change the password at once after news of a data leak

Testing Your Login for Weaknesses

A test shows whether your login can stand up to credential stuffing. In a penetration test, experts check, among other things, whether login attempts are limited, whether MFA can be bypassed and whether error messages reveal which user names exist.

Conclusion

Credential stuffing exploits the fact that many people reuse passwords. A single data leak is enough to put accounts at completely different services at risk. The best protection comes from MFA or passkeys, blocked leaked passwords, bot defense and good monitoring of logins.