Credential stuffing is the automated replay of username and password pairs stolen from one service against the login pages of many other services. It works for one reason: password reuse. A New York University study of 61.5 million real-world credentials, presented at IEEE S&P in 2023, found that roughly 16 percent of reused credentials were reused across multiple compromised datasets — each new breach restocks the attackers' supply.
KAJ News publishes information and practical defense, not incident response; if an account has already been taken over, the provider's account-recovery process comes first.
How does a stuffing attack actually work?
The attack has three documented stages. First, a breach or a compiled list of credentials, often called a combo list, supplies millions of email-and-password pairs. Second, automated tools replay those pairs against a target's login endpoint, distributed across thousands of IP addresses and routed through residential proxy networks so the traffic looks like ordinary users. Third, the small fraction that succeeds is logged — typically 0.1 to 2 percent of attempts, per the Open Web Application Security Project's automated-threats handbook — and those working credentials are either sold or used directly.
A one-percent success rate sounds small. Against a list of ten million pairs it is one hundred thousand working logins.
Why don't rate limits and CAPTCHAs stop it?
They raise the cost, which is the honest answer. Attackers pace requests below lockout thresholds, rotate IP addresses, and solve or avoid CAPTCHAs, so defenses that assume one attacker at one door fail against distributed, patient replay. OWASP's credential-stuffing prevention notes, current as of 2024, list the controls that actually matter on the service side: breach-password screening against known-compromised passwords, device fingerprinting, and step-up multi-factor authentication on suspicious sign-ins. None of these rely on the user, which is why regulators keep pushing them onto services.
How do you know if you've been hit?
Four signals recur in documented incidents. A sign-in alert from a country you have never visited. A password-changed email you did not request. Locked-out messages on an account you still know the password for. And spam or purchases inside a service you rarely use. Any one of these means someone had working credentials — the question is which reuse supplied them.
Check the account's security page for active sessions and recent sign-in history before changing anything, so evidence is not destroyed. Then change the password and every other place it was used.
What stops credential stuffing for good?
One habit and one technology. The habit: a password manager generating a unique password per account, which makes replaying credentials worthless — a leaked pair unlocks nothing else. The technology: multi-factor authentication, which keeps a working password from being sufficient. CISA's multi-factor guidance, updated 2024, recommends phishing-resistant MFA — passkeys or security keys — for accounts that matter.
Do the email account first. Email resets every other account's password, so it is the single highest-value target in any stuffing run.
What does the evidence say about scale?
Stuffing is an industrial process. The UK's National Cyber Security Centre reported in 2021 that the NCA and NCSC had uncovered a file containing over 10 billion unique username-password pairs assembled from past breaches, and Google's Safe Browsing research published in 2019 examined 1.4 billion credentials exposed in breaches and found substantial overlap with active phishing kits. The U.S. Federal Bureau of Investigation's Internet Crime Complaint Center has repeatedly attributed account-takeover losses to credential replay in its annual Internet Crime Report, with 2023 losses across all complaint categories exceeding $12 billion.
Those figures establish the scale of supply. What they cannot establish is any single account's risk on any given day, which is why the defense above is a habit rather than a one-time project.
For more context, read NIST Awards Over $1.2 Million to Small Businesses.