What Is Credential Stuffing?

Credential stuffing is the reason a breach at a site you barely use can end up compromising your email, your bank account, or your social media — even though those services were never breached themselves. It's one of the most common attack techniques in use today, precisely because it's cheap, automated and relies entirely on a habit most people still have: reusing passwords.

How it actually works

After a data breach, the stolen username-and-password pairs end up in large combined lists, often merged from many different breaches over the years. Attackers feed these lists into automated tools that rapidly try each pair against the login pages of banks, email providers, retailers and social platforms — not because they know anything about you specifically, but because they know a meaningful percentage of people reuse passwords across services. It's a numbers game, run at massive scale using bots that can attempt thousands of logins per minute.

Why it works so well

It works because it doesn't require breaking any encryption or guessing anything — it's simply trying credentials that are already known to be valid somewhere, on the chance they're valid somewhere else too. A password can be genuinely strong, long and complex, and credential stuffing will still succeed against it if that exact password was reused on a site that got breached.

How to tell if you've been targeted

Signs include login notifications from unfamiliar locations or devices, password reset emails you didn't request, or account activity you don't recognise. Because the attack is automated and untargeted, being caught up in it doesn't mean you were specifically singled out — it means your credentials happened to appear on a list that got tried.

The one fix that stops it completely

Credential stuffing only works because of password reuse. A unique, generated password for every single account makes the entire attack category irrelevant — a breach at one site simply has nothing to try anywhere else. Combine that with two-factor authentication and even a reused password becomes far less useful to an attacker, since the correct credentials alone are no longer enough to get in.

What sites do to fight it, and why it's not enough on its own

Many services now deploy rate limiting, CAPTCHAs, and breach-list screening at signup to blunt credential stuffing attempts. These help, but they're a backstop, not a substitute for the fix that actually closes the gap: unique passwords, everywhere, all the time.