Credential stuffing: what it is and how to protect yourself

Reusing one password across several accounts is convenient, and it sets you up for trouble that cascades across your digital life. The habit creates the opening for credential stuffing: taking a list of previously exposed logins and systematically feeding the username and password pairs into the sign-in forms of chosen services. Where the same credentials are recycled, a single pair can open accounts that have nothing to do with each other.

It is the digital equivalent of a skeleton key that opens the house, the office and the safe in one sweep — and finding the key is not difficult. It can be lifted from past data breaches and cybercrime markets, or pulled off a compromised device and out of a browser by infostealer malware.

What makes it so effective

The technique pays off because of how readily people reuse passwords, including on accounts that matter: banking, email, social media and shopping. In one recent survey, 62% of American respondents admitted to reusing a password often or always.

Once credentials turn up in one place, they get tried everywhere. Bots and automated tools do the stuffing, sometimes rotating IP addresses and mimicking the behaviour of a real user to stay below the threshold that would trigger an alert.

Compared with brute force — guessing a password from random or common patterns — credential stuffing is simpler, because it relies on what people or their services have already exposed, often years earlier. It is also quieter. Where repeated failed logins would set off alarms, credential stuffing works with credentials that are already valid, so the attempts look like ordinary traffic.

The technique is not new, but several trends have made it worse. Infostealer malware has exploded in volume, quietly capturing credentials straight out of browsers, and password managers are not entirely out of its reach. At the same time, AI-assisted scripts can imitate normal human behaviour well enough to slip past basic bot defences while testing credential pairs faster and at greater scale.

The scale is worth putting numbers on:

• In 2022, PayPal reported that nearly 35,000 customer accounts had been compromised through credential stuffing. The company itself was not breached — attackers used login details from older leaks to reach accounts belonging to people who had recycled the same password across several services.
• A 2024 wave targeting customers of Snowflake showed another dimension of the problem. The data storage and processing service itself was not breached, but around 165 of its customer organisations were affected, after attackers used credentials previously stolen by infostealer malware to sign in. Some of those victims later received ransom demands for their data.

How to protect yourself

• Do not reuse a password across sites or services. A password manager makes this easy, generating and storing a strong unique password for each account.
• Turn on two-factor authentication wherever it is offered. Even with the password known, the second factor is what stops the sign-in.
• Check whether your address has already appeared in a breach, using a breach-notification service, and change the passwords on anything affected — starting with the accounts holding the most sensitive data.

How to protect an organisation

Credential stuffing is a primary route to account takeover, fraud and large-scale data theft across retail, finance, software and healthcare. Many organisations still rely on passwords alone for authentication, and even where 2FA is available it is often not enforced by default. The measures that help are cumulative: restrict login attempts, require network allow-lists or IP whitelisting, monitor for unusual login activity, and adopt bot detection or CAPTCHA to block automated abuse.

Passwordless authentication is the direction many organisations are moving in, and passkeys in particular make credential stuffing useless. Adoption is still uneven, and old habits are hard to break, so the technique continues to return a great deal to attackers for very little effort. Millions of leaked credentials stay valid long after a breach, especially where nobody ever changes them — which is what keeps this cheap, scalable and consistently effective.

Conclusion

Credential stuffing is a simple, inexpensive and scalable attack. It works because it uses our own habits against us and because it slips past safeguards that were designed for a different threat. Unless you are ready to move beyond passwords completely, the risk of being broken into this way is neutralised by password practice — not as an optional improvement, but as standard.