What is credential stuffing? How one breach becomes many

Credential stuffing is the attack that turns somebody else's security failure into your problem.

It works like this. A company you signed up to years ago is breached, and its email-and-password pairs end up in circulation. Attackers take those pairs and feed them, automatically, into the login forms of hundreds of other services — banks, email providers, retailers, social platforms — checking where else the same combination works.

Nothing is guessed. The passwords are already correct somewhere.

Why it succeeds

Because password reuse is close to universal, and the attack is built precisely around that fact.

The NCSC lists this behaviour among the primary ways passwords are discovered: "using the passwords leaked from data breaches to attack other systems where users have used the same password". It sits alongside phishing and password spraying as a standard technique, not an exotic one.

The attacker does not need to succeed against you. They need to succeed against enough people, and reuse guarantees they will.

Why you cannot see it happening

This is what distinguishes it from other attacks, and why it is so effective.

Every individual attempt is a correct password submitted to a login form. There is no burst of failures, no lockout, no anomaly. From the service's perspective it looks like an ordinary successful sign-in, because that is exactly what it is.

Attackers further distribute attempts across large numbers of residential IP addresses and pace them slowly, so nothing looks like a single source hammering a single service.

The first sign you get is usually the consequence — a password reset you did not request, a purchase you did not make, a login alert from a country you have not visited.

What happens after a successful hit

The order is fairly consistent, and email comes first.

Email is the highest-value target, because it is the reset mechanism for everything else. Someone with your inbox does not need your banking password — they can request a new one. Compromised mailboxes also get silent forwarding rules added, which survive a password change.

Financial accounts get drained or used for purchases. Retail accounts with stored cards get used, and stored addresses get harvested. Social accounts get used to scam your contacts, who trust messages from you.

Access is also frequently resold rather than used, which is why the consequence sometimes arrives months after the breach that caused it.

Finding out whether you are exposed

• Have I Been Pwned — search your email address against known breach corpora.
• Pwned Passwords — check whether a specific password appears in a breach, without sending the password itself.
• Your password manager — most will flag saved passwords that are reused, weak, or found in a known breach.

NIST's current guidance requires services to run this check themselves, blocking new passwords that appear on a blocklist of "commonly used, expected, or compromised" values. Many still do not, so checking yourself is worth the five minutes.

If one of those checks comes back positive, or a breach notice has already arrived, what to do when a password is exposed in a breach sets out the response in order.

The two things that stop it

1. Unique passwords

This ends the attack completely. A password that exists on exactly one service cannot be replayed anywhere, so a breach of that service compromises that account and nothing else.

You cannot do this from memory, which is the entire argument for a password manager.

2. Two-factor authentication

This stops the attack even when the password is already known and correct. Whatever the attacker holds, they do not hold your second factor.

Passkeys are stronger still — there is no reusable credential to leak in the first place, so there is nothing to stuff.

Not every credential in a stuffing run came from a company breach. A large share is copied straight off people's own devices — infostealer malware explains that supply line and why password strength does nothing against it.