Credential Stuffing

What it is

Credential stuffing tests username-password pairs stolen from one service against other services. It depends mainly on reuse rather than guessing an unknown password. An account can therefore be taken over even when the targeted service was never breached. Email addresses commonly provide the connection between records on different sites.

How it works

Automated clients submit leaked pairs at scale and check which accounts accept them. Attackers may distribute requests to avoid simple controls. Successful logins can lead to fraud, resale of accounts, or collection of more information. A correct password does not establish that the person submitting it is the legitimate owner.

How people get tricked

Users reuse a convenient credential because they regard accounts as separate. A breach at a low-value site then supplies access to a higher-value one. There may be no new message or interaction to warn the user before the attack.

Example scenario

Credentials leaked from an old shopping account also work at a streaming service and email account. The attacker did not crack either service's password storage; they replayed a valid reused secret.

Warning signs

• A wave of automated sign-ins, including some successful attempts.
• New-device alerts after a breach on an unrelated service.
• Unauthorized purchases or account changes without a local malware explanation.

If it happens to you

Change the reused password everywhere, revoke sessions, and review transactions and recovery settings. Start with email and critical accounts. Providers should investigate affected users and the campaign rather than merely blocking one address used by automation.