Key Points
- Credential stuffing is an automated attack that injects stolen username-password pairs into login forms on unrelated sites, betting on reuse.
- Attackers automate the attack in stages: harvesting credentials, running them through bots, validating hits, then draining or reselling accounts.
- Credential stuffing differs from brute force because it uses real breached credentials, not guessed ones, blending into normal login traffic.
- MFA reduces account takeover but can be worn down by prompt bombing, so defenses need bot detection and password screening.
- Certificate-based authentication removes the password entirely, leaving no credential for an attacker to stuff into a login form.
Every large data breach hands criminals a fresh list of usernames and passwords. They do not need to guess your password when they can simply try the one you already used somewhere else. That is credential stuffing: an automated attack that turns password reuse into account takeover, one login form at a time.
This guide breaks down how a credential stuffing attack works, how it differs from a brute-force attack, why the volume of attempts keeps climbing, and what stops it. The short answer to that last question involves removing the password from the equation, not just adding another layer on top of it.
What Is Credential Stuffing?
Credential stuffing is the automated submission of stolen username and password pairs into website login forms in an attempt to take over accounts on services the victim never intended to expose.
The credentials themselves usually come from an unrelated breach: a retailer, a forum, a SaaS tool. The attacker doesn’t care where the credentials came from. They only care whether the victim reused that same email and password combination on a bank, an email provider, or a corporate virtual private network (VPN).
At its core, credential stuffing is a password reuse attack. It works because password reuse is common, not because any single password was weak. A perfectly strong password still fails if it was exposed once and reused twice.
How Does a Credential Stuffing Attack Work?
A credential stuffing campaign moves through a repeatable sequence. Each stage is largely automated, which is what makes the attack scalable across millions of accounts at once.
- Credential harvesting: The attacker acquires breached username and password pairs from leak forums, paste sites, or purchased “combo lists” compiled from prior breaches.
- List preparation: The list gets deduplicated, formatted, and matched against target login pages. Attackers often rotate the list through residential proxy networks so the traffic looks like it is coming from thousands of ordinary users instead of one source.
- Automated testing: Bot software submits each credential pair against the target’s login form, typically trying every pair once per site to avoid tripping lockout thresholds.
- Validation and exploitation: Successful logins get flagged, sorted, and either drained directly (loyalty points, stored payment methods, personal data) or resold on criminal marketplaces as confirmed, working accounts.
Because each credential is only tried once per account, the traffic can look almost identical to normal login activity, which is why volume-based rate limiting alone rarely catches it.
Credential Stuffing vs. Brute Force Attacks
Credential stuffing is often grouped with brute-force attacks, but the mechanics are different enough to require different defenses.
OWASP classifies credential stuffing as a subset of brute-force attacks that specifically uses known, breached username and password pairs against other sites, rather than guessing at passwords blindly.
| Dimension | Credential Stuffing | Brute Force |
| Data used | Real, breached username and password pairs | Guessed or generated password combinations |
| Login attempts per account | Usually one attempt per pair, per site | Many repeated attempts against the same account |
| Detection difficulty | Blends into normal login traffic | Easier to flag through repeated failed logins |
| Password strength impact | Strength doesn’t matter if reused | Strength directly slows the attack |
A strong, unique password stops brute force cold. It does nothing against credential stuffing if that same password was exposed somewhere else first.
Why Are Credential Stuffing Attacks on the Rise?
Three trends are driving the growth in credential stuffing volume.
First, breach data keeps compounding. Recaptured identity records reached more than 53.3 billion in 2024, a 22% increase over the prior year, giving attackers a constantly refreshed supply of credential pairs to test. Roughly 70% of people exposed in a breach were found to be reusing an old, already-compromised password, which is exactly the behavior credential stuffing depends on.
Second, the tooling got cheaper and more accessible. Off-the-shelf bot frameworks and rentable residential proxy networks let low-skill attackers run large campaigns without building any infrastructure themselves.
Third, stolen credentials are a common way into a network. Compromised credentials were an initial access vector in about 22% of breaches reviewed in Verizon’s 2025 Data Breach Investigations Report. The same research found credential stuffing attempts accounted for roughly 19% of daily authentication traffic across the single sign-on (SSO) logs analyzed, a volume large enough to hide inside routine login activity.
Who Credential Stuffing Targets Most
Any login form is a target, but attackers concentrate effort where a confirmed hit pays off fastest.
- Financial services and payment platforms: A working login often exposes stored payment methods or lets an attacker initiate a transfer directly.
- Retail and e-commerce accounts: Saved cards, gift card balances, and loyalty points can be drained or resold quickly.
- Streaming and media services: Account access itself has resale value on gray markets, even without any financial data attached.
- Healthcare and genetic data platforms: Accounts often unlock highly sensitive personal and family data that cannot be reset like a password.
- Corporate VPN and application portals: A single reused employee password can be the opening move into a much larger network compromise.
Real-World Examples of Credential Stuffing Attacks
The 2023 breach at 23andMe is one of the clearest examples of credential stuffing in practice. Starting in April 2023 and continuing for several months, an attacker fed usernames and passwords pulled from unrelated prior breaches into the 23andMe login page until pairs matched.
Roughly 14,000 accounts were directly compromised this way. Because many of those users had opted into a relative-matching feature that shared profile data across connected accounts, the attacker was able to scrape genetic and ancestry data tied to about 6.9 million users in total.
Tech Target
The breach illustrates the asymmetry of credential stuffing: a small number of successful logins, amplified by a feature that shared data across accounts, affected an enormous downstream population.
How to Detect and Prevent Credential Stuffing Attacks
No single control stops credential stuffing on its own. Effective defense combines several layers.
- Bot detection and rate limiting: Flag traffic patterns consistent with automated login attempts, including unusual velocity, proxy-heavy IP ranges, and login attempts that skip normal browser behavior.
- Breached-password screening: Check new and existing passwords against known breach corpora at signup and login, and force a reset if a match is found.
- Credential hashing and salting: Store passwords using a strong, salted hash so that even if a database is stolen, the raw credentials are not immediately usable elsewhere.
- Anomaly detection: Watch for logins from new devices, unusual locations, or impossible travel patterns, and challenge or block sessions that don’t match a user’s normal behavior.
- Multi-factor authentication (MFA): Adding a second factor blocks most stuffed credentials from resulting in a full takeover.
MFA is the most commonly recommended defense, and it does meaningfully reduce successful account takeover. It is not, however, a complete answer. Push-based MFA can be worn down through prompt bombing, also called MFA fatigue. An attacker who already has a valid password can flood a user’s phone with approval requests until the user accepts one out of exhaustion or confusion.
That is close to what happened in Uber’s 2022 breach, where an attacker used a contractor’s stolen password to trigger repeated MFA push prompts until one was approved. The password was still the entry point. MFA only slowed down what came next, and even that didn’t hold.
Not all MFA carries this weakness. Phishing-resistant forms of MFA, including public key infrastructure (PKI)-based certificates, are not vulnerable to prompt bombing or credential phishing the way push notifications and one-time codes are. That distinction matters more than the MFA label itself.
Certificate-Based Authentication Removes the Target
Every defense discussed so far assumes a password still exists somewhere in the system. Rate limiting, breached-password screening, and anomaly detection all work to catch misuse of a credential after the fact. They don’t remove the credential that makes the attack possible in the first place.
Certificate-based authentication does. Instead of a username and password, the user or device presents a non-exportable digital certificate tied to that specific device and identity.
Certificate-based authentication gives a bot nothing to work with. A certificate can’t leak into a breach dump or be reused across sites, so there’s no credential left to stuff into a login form.
Protocols like Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) use this model to authenticate Wi-Fi and VPN connections directly against a certificate rather than a password, which is also how modern 802.1X network authentication is deployed at scale.
Hardware security keys and PIV smart cards are considered phishing-resistant for the same reason. The private key never leaves the device, so there is nothing for an attacker to harvest.
How SecureW2 Eliminates the Reusable Password
Credential stuffing works because most organizations still ask users to prove identity with a password that can be copied, leaked, and reused. Our JoinNow Dynamic PKI replaces that password with a certificate issued to a specific user and device, so there is no credential sitting in a breach dump waiting to be tried against your login pages.
Paired with our JoinNow Cloud RADIUS, every authentication request checks identity and device trust in real time against your existing identity provider, whether that’s Entra ID, Okta, or Google Workspace. If a device falls out of compliance or a user is disabled, access is revoked immediately, without anyone resetting a password.
Schedule a demo to see how certificate-based authentication removes the reusable password that credential stuffing depends on across Wi-Fi, VPN, and application access.
Frequently Asked Questions
What is credential stuffing?
Credential stuffing is an automated attack that takes username and password pairs stolen in one data breach and submits them to login forms on unrelated websites, hoping the victim reused that same combination somewhere else. It relies entirely on password reuse rather than on weak or guessable passwords.
What is the difference between credential stuffing and brute force attacks?
Brute force guesses at passwords, often repeatedly testing many combinations against a single account. Credential stuffing uses real, previously breached credentials and typically tests each pair only once per account, which makes it harder to detect through simple failed-login thresholds.
Does MFA stop credential stuffing?
Mostly, but not entirely. MFA blocks a stuffed credential from becoming a full account takeover in the majority of cases, which is why it remains a baseline recommendation. Push-based MFA, however, can be worn down through prompt bombing, and one-time codes can be phished in real time. Phishing-resistant methods, such as certificates and hardware keys, close those gaps because there is no prompt to fatigue and no code to intercept.
How do I know if my credentials have been part of a breach?
Free services like Have I Been Pwned let you check whether your email address appears in known breach data, and most major browsers and password managers now flag saved passwords that have shown up in a leak. If a password appears in breach data, assume it will eventually be tried in a credential stuffing attack and stop using it everywhere — not just on the site that was breached.
Is credential stuffing illegal?
Yes. Accessing accounts with stolen credentials violates computer fraud laws in most jurisdictions — in the United States, under the Computer Fraud and Abuse Act — regardless of how the credentials were obtained. Buying or selling combo lists is also prosecutable in many jurisdictions. Legitimate security teams simulate credential stuffing only against systems they own or are contracted to test.
Can a password manager prevent credential stuffing?
It removes the condition the attack depends on. A password manager makes it practical to use a unique password for every account, so a credential exposed in one breach opens exactly one account instead of many. It doesn't stop the stuffing attempt itself, and the account whose password leaked is still compromised — which is why unique passwords are the floor, and removing passwords entirely is the stronger fix.
