What Is Credential Stuffing?

How Credential Stuffing Works

The raw material for credential stuffing is breach data — the usernames and passwords exposed in data breaches. This data is bought and sold on criminal marketplaces, compiled into massive databases, and is increasingly available through free data leak sites. Collections of breach data totaling billions of username and password pairs are accessible to attackers. The attack process is automated: credential stuffing tools test breach credentials against target services at scale, rotating through proxy networks to evade IP-based rate limiting, distributing requests to avoid triggering account lockout policies, and automatically logging successful authentications for collection.

Why It Works at Scale

Password reuse is pervasive. Studies consistently show that 65% or more of people reuse passwords across multiple accounts. When a breach exposes 50 million credentials from a retail loyalty program, the majority of those users have used the same password on other services — their bank, their Microsoft 365 account, their healthcare portal. The attacker does not know which credentials are reused where; the automation tests them all and collects the successes.

Defending Against Credential Stuffing

Multi-Factor Authentication

MFA is the most effective defense against credential stuffing because a valid username and password is insufficient for authentication when a second factor is required. An attacker who successfully matches a stuffed credential still cannot complete authentication without the second factor. This is one context where even SMS-based MFA provides significant protection — the attacker has the password but not the phone.

Breached Credential Detection

Services like Have I Been Pwned provide APIs that allow authentication systems to check whether credentials being used for login appear in known breach databases. Microsoft Entra ID's Password Protection feature blocks passwords that appear in known breach data. Proactively checking existing credentials against breach databases and requiring password resets for compromised credentials prevents stuffing attacks using credentials that were breached from your own or other services.

Credential Stuffing in the Enterprise

Credential stuffing against enterprise applications uses the same mechanics as consumer account targeting, with additional attack paths unique to enterprise environments. Legacy enterprise applications without modern authentication support may not be compatible with MFA, creating bypass paths. Service accounts with static credentials that are never rotated and that appear in breach data from years of developer reuse across personal and professional contexts represent persistent credential stuffing targets. And the volume of enterprise credentials in breach data increases with every major breach of enterprise software vendors — Okta, LastPass, and similar platforms whose customer credential data has been exposed in incidents.

Related Reading

• Identity and Access Management (IAM) — the discipline that detects and prevents credential reuse
• Spear Phishing — the alternative credential-theft vector
• Business Email Compromise (BEC) — where credential stuffing frequently enables initial access

What is credential stuffing?

Credential stuffing is an automated attack that uses username and password combinations stolen in previous data breaches to attempt unauthorized access to other services. The attack exploits password reuse — when a breach at Service A exposes credentials, attackers test those same credentials against Services B, C, and D, succeeding wherever the victim reused their password. The raw material is breach data, the mechanism is automation, and the success condition is password reuse.

How is credential stuffing different from brute force?

Brute force attacks attempt many different passwords against one account. Credential stuffing attempts one known credential pair (from breach data) against many services. Brute force hits per-account lockout thresholds quickly; credential stuffing distributes its attempts across many accounts and services, avoiding lockout altogether. They are different attacks against different weaknesses — brute force targets weak passwords, credential stuffing targets password reuse.

Why does credential stuffing work so well?

Password reuse is pervasive — studies consistently show that 65% or more of users reuse passwords across multiple accounts. The Have I Been Pwned database contains over 12 billion compromised credentials. Even at a 0.1% success rate, a credential list of 100 million pairs yields 100,000 successful account takeovers. Volume is the mechanism, and the volume of available breach data grows with every major breach.

What is the success rate of credential stuffing attacks?

Industry reports consistently place success rates at 0.1% to 2% of attempted credential pairs per target service, with variation depending on the source breach data freshness and the target's banned-password and MFA controls. Against a list of 100 million breached credentials, even 0.1% means 100,000 successful authentications — sufficient to fund a meaningful criminal operation or seed a major fraud campaign.

How can credential stuffing be detected?

Detection signals include authentication attempts from rotating IP addresses, high failure-to-success ratios at the service level, geographically anomalous authentication patterns, and use of automation user agents. Identity platforms like Microsoft Entra ID Protection, Okta ThreatInsight, and Auth0 Bot Detection provide native credential stuffing detection. Cloudflare and other CDN providers offer bot detection at the network edge. Web Application Firewalls with rate limiting and behavioral analysis provide defense at the application layer.

Does MFA prevent credential stuffing?

MFA is the most effective single defense against credential stuffing because a valid username and password pair is insufficient when a second factor is required. Even SMS-based MFA, which is weak against targeted phishing, is highly effective against credential stuffing — the attacker has the password but not the phone. Phishing-resistant MFA (FIDO2, passkeys) provides defense even against the sophisticated AiTM phishing kits that defeat push notifications.

What is the difference between credential stuffing and password spraying?

Credential stuffing uses known credential pairs from breach data — username and password together — against many services. Password spraying uses common passwords (the current month and year, the company name, "Welcome1") against many usernames. Stuffing exploits password reuse; spraying exploits weak password selection. Stuffing succeeds when the victim used the same password elsewhere; spraying succeeds when a user picked a common password from the start.

Real-World Example: The Credential Stuffing Economy

In 2023, researchers identified a credential stuffing operation that had processed over 3 billion login attempts against a single financial services firm over 18 months. The operation used rotating residential proxy networks to appear as legitimate user traffic, throttled request rates to avoid triggering lockout policies, and targeted the firm's mobile application specifically because its authentication controls were less restrictive than the web application. The attackers successfully authenticated to over 300,000 accounts during the campaign before detection. The credential lists used were primarily from consumer service breaches that had occurred 2-5 years earlier, demonstrating that breach credential value persists long after the initial incident.