Credential Stuffing Defined in Plain Terms
Credential stuffing is the automated testing of stolen username and password pairs against login pages, so attackers can take over accounts without ever breaking into your systems. The credentials come from other companies’ breaches. Because many people reuse the same password across sites, one old leak can open accounts everywhere.
The method scales because three things line up. Billions of leaked credentials circulate online, cheap tools automate millions of login attempts and password reuse is still normal. In its 2022 guide, the New York Attorney General cited a 2020 study estimating more than 15 billion stolen credentials in circulation, a figure that has almost certainly grown since.
For a business, a successful attempt is not a minor nuisance. It means account takeover, fraud and, if personal data sits behind the account, a reportable breach.
How a Credential Stuffing Attack Works
A credential stuffing attack runs in four plain steps, and none of them needs much skill.
- Get a list: the attacker buys or collects a combo list, thousands or millions of username and password pairs leaked from unrelated breaches and traded on criminal forums.
- Automate the logins: the list is loaded into tooling that submits login attempts at speed.
- Spread the traffic: attempts are distributed across many IP addresses and proxy networks so no single address trips a rate limit. OWASP notes that credential stuffing toolkits ship with proxy support for exactly this.
- Abuse what opens: the pairs that log in are used for fraud or resold to other criminals.
Most attempts fail, and that is priced in. The New York Attorney General found that a single run across a large list still opens thousands of accounts, which is why the economics work for the attacker. The lists are cheap, the tools are point and click and the success rate does not need to be high.
Types of Credential Attacks
Credential stuffing belongs to a family of attacks on login pages. They can look alike from the outside, but each starts from very different information.
- Credential stuffing: replays real username and password pairs already leaked from another breach. Password strength does not help, because the password is already known.
- Brute force: guesses passwords from scratch against an account. A long, unique password defeats it.
- Password spraying: tries a few common passwords across many accounts at once to stay under lockout thresholds.
You will also see the term password stuffing. It is just another name for credential stuffing and describes the same replay attack, not a separate technique.
Credential stuffing is the entry, and account takeover is the result. From a hijacked account an attacker can commit fraud, read data or pivot deeper into a system. OWASP catalogues credential stuffing as automated threat OAT-008 and treats it alongside brute force and password spraying.
The Business Impact of Credential Stuffing
The damage lands in several places at once, not just on the accounts that are opened.
- Account-takeover fraud: hijacked accounts are used for fraudulent purchases, stored-value theft and payment abuse.
- Data breach and fines: if accounts hold personal data, a successful attack is a reportable breach. The UK ICO fined 23andMe £2.31 million over a credential stuffing attack, even though 23andMe’s own systems were never breached.
- Infrastructure load: the flood of automated logins degrades performance and raises costs on its own.
- Customer trust: takeovers, forced resets and fraud notices wear down confidence and drive churn.
The scale is not marginal. According to Verizon’s 2026 Data Breach Investigations Report, vulnerability exploitation overtook credential abuse as the leading initial access vector for the first time in the report’s 19-year history. Vulnerability exploitation accounted for 31% of breaches, compared with 13% for credential abuse. However, stolen credentials remained a major threat, with credential abuse involved in 39% of breaches at some point during the attack.
The New York Attorney General found more than 1.1 million accounts compromised across 17 companies and noted that several of the companies had not detected the attacks that had compromised their customers’ accounts. The cost is rarely one line on a budget. It is fraud, engineering time, legal exposure and lost customers together.
Real-World Cases
Three cases show the same pattern playing out across different industries.
The 23andMe Breach (2023)
From April to September 2023, attackers ran stolen credentials against 23andMe’s login page and directly accessed about 14,000 accounts, roughly 0.1 percent of its 14 million customers. 23andMe’s own systems were never breached.
Through the DNA Relatives and Family Tree features, those 14,000 accounts exposed data on about 6.9 million connected people. The company disclosed the attack in October 2023.
The UK ICO fined 23andMe £2.31 million in 2025, pointing to a failure to prepare for, monitor and respond to credential stuffing. Required multi-factor authentication and breached-credential monitoring would have blunted it.
The PayPal Attack (2022)
Between 6 and 8 December 2022, attackers used credentials leaked elsewhere to access about 35,000 PayPal accounts. PayPal confirmed the activity on 20 December and reset the affected passwords.
Exposed data could include names, addresses, dates of birth and national tax or Social Security numbers. PayPal reported no evidence of misuse or unauthorised transactions and gave affected users two years of identity monitoring.
PayPal’s own advice named the fix. Turn on two-factor authentication and stop reusing passwords across sites.
The Roku Incidents (2024)
Roku found two credential stuffing waves in early 2024. The first reached 15,363 accounts. While watching for more, Roku uncovered a second wave affecting about 576,000 accounts, for 591,363 in total.
In fewer than 400 cases, attackers used stored card details to buy subscriptions and hardware, which Roku refunded. No full card numbers or Social Security numbers were taken.
Roku’s response was to make two-factor authentication mandatory for all 80 million-plus accounts, not only the ones that were hit. The monitoring that surfaced the second wave is the part worth copying.
Credential Stuffing and Compliance
For Swedish and EU organisations, defending the login against credential stuffing is closer to a legal duty than an optional extra.
NIS2 and Cybersäkerhetslagen: NIS2 Article 21(2)(j) names multi-factor authentication as a required measure, the first time EU law has named MFA directly. Article 21(2)(i) covers access control. Article 20 makes the management body approve and oversee these measures, with personal accountability for failures. In Sweden the directive is law as Cybersäkerhetslagen, SFS 2025:1506, in force since 15 January 2026. See our NIS2 compliance guide.
A credential stuffing attack that disrupts services or exposes data also triggers the reporting cascade to MCF (formerly MSB). That is a 24-hour early warning, a 72-hour notification and a final report within one month.
GDPR: where leaked-credential access exposes personal data, GDPR Article 32 requires appropriate security and Article 33 requires notifying IMY within 72 hours. The 23andMe fines show regulators will act on a credential stuffing failure. See our GDPR compliance guide.
DORA: financial entities fall under DORA, which requires strong authentication and access control and is supervised by Finansinspektionen. See our DORA compliance guide.
How to Spot a Credential Stuffing Attack
Credential stuffing is hard to see from the user’s seat, because every attempt uses a real password and looks like an ordinary failed login. The signals live in your logs.
- A sudden spike in login traffic or failed-login rate.
- A surge in account lockouts.
- Logins from many unfamiliar IP addresses and countries in a short window.
- Impossible travel, where one account signs in from distant places minutes apart.
- Traffic concentrated on the login endpoint rather than the rest of the site.
- A rise in customer reports of locked or changed accounts.
Detection has a ceiling. The credentials are valid, and attackers spread attempts across many addresses and slow them down to blend in. Spotting a campaign matters, but it will not stop one on its own, which is why prevention has to sit underneath.
How to Defend Against Credential Stuffing
No single control stops credential stuffing, so defence works in layers across people, process and technology. Start with the controls that carry the most weight.
- Require multi-factor authentication, ideally phishing-resistant methods like passkeys. OWASP and NIS2 both put MFA first. Implement it fully, because a half-finished rollout still leaves gaps.
- Screen passwords against known-breach lists at signup and reset, and across your existing users. NIST SP 800-63B makes this a requirement and drops forced periodic rotation, which only pushes people toward weak, predictable passwords.
- Deploy bot detection and management, using device and behavioural signals. CAPTCHA helps but has limits, since attackers use solver services.
- Rate-limit logins and monitor login telemetry so a spike is caught early.
- Block or challenge traffic from known-bad IP addresses, proxies and datacentre ranges.
- Move toward passwordless sign-in, which removes the reusable password attackers depend on.
- Do not use an email address as the only username, which makes combo lists easier to build.
Encourage unique passwords and a password manager, and check whether your own domains already appear in leaked-credential data. eBuilder Security’s domain breach detector runs that check.
Finally, write down how you will respond to an attack and make sure someone is watching for one. Continuous monitoring is what turns a silent campaign into an alert. eBuilder Security’s managed detection and response and penetration testing cover both the watching and the testing of your login defences. Treat the login page as an exposed front door, and defend it like one.
