In 2012, LinkedIn lost a database of user passwords. For years afterward, accounts on completely unrelated services - Dropbox among the most famous - Were compromised using those same credentials. Nobody hacked those other sites. Nobody needed to. The victims had reused their LinkedIn password elsewhere, and attackers simply tried it everywhere.
That's credential stuffing: the least glamorous attack in security and, by volume, one of the most successful. It requires no zero-days, no cracking rigs, no social engineering. It's a login replay at industrial scale, and the only vulnerability it exploits is a human habit - Using the same password twice.
The mechanics: from breach to takeover
Credential stuffing runs on a simple supply chain.
Step one: the raw material. Every data breach that includes passwords feeds the ecosystem. Cracked or plaintext credentials get merged into "combo lists" - Huge text files of email:password pairs. These circulate on forums and Telegram channels for trivial sums, and mega-compilations stitch together billions of pairs from hundreds of breaches. Have I Been Pwned, the breach-notification service run by Troy Hunt, now indexes over 14 billion breached accounts - A rough measure of how much raw material is in circulation.
Step two: the tooling. Off-the-shelf tools like OpenBullet take a combo list and a "config" for a target website, then fire login attempts through networks of residential proxies so the traffic looks like thousands of ordinary users on home connections rather than one attacker. CAPTCHA-solving services are bolted on for a few dollars per thousand solves.
Step three: the harvest. The tool sorts results into hits and misses. Hits - Valid logins - Are either exploited directly (drained loyalty points, stored payment cards, gift card balances) or resold in bulk, neatly sorted by service.
Notice what's absent: guessing. Credential stuffing doesn't attempt to figure out your password the way the techniques in how hackers crack passwords do. It already has your password. The only question is which other doors it opens.
Why tiny success rates equal huge damage
Stuffing success rates sound reassuringly low - Industry estimates from firms like F5 and Akamai typically land between 0.1% and roughly 2% of attempted logins. But the arithmetic is brutal at scale.
| Combo list size tested | Success rate | Accounts taken over |
|---|---|---|
| 100,000 pairs | 0.5% | 500 |
| 1 million pairs | 0.5% | 5,000 |
| 10 million pairs | 1% | 100,000 |
| 100 million pairs | 0.5% | 500,000 |
Akamai has measured credential-stuffing attempts in the tens of billions per year across its network - 193 billion in 2020 alone. Against that volume, a fraction of a percent is a business. And the economics favor the attacker completely: the credentials cost almost nothing, the compute is negligible, and each takeover of a retail, streaming or airline-miles account has direct resale value.
The reason those percentages exist at all is reuse. Survey after survey finds the same thing: in LastPass's Psychology of Passwords research, a large majority of respondents admitted reusing passwords across accounts even though they knew the risk, and a Google/Harris poll found 52% of people reuse a password across multiple accounts, with 13% reusing one password everywhere. Every one of those people is a potential "hit" waiting in a combo list. More numbers like these live in our roundup of password statistics.
Rule of thumb: a reused password is only as safe as the least secure site you ever used it on - And you don't get to know which site that is.
Stuffing vs. spraying vs. brute force
Credential stuffing gets lumped in with other login attacks, but the distinctions matter because the defenses differ.
- Credential stuffing replays known email-password pairs from breaches. Defense: never reuse passwords.
- Password spraying tries a few common passwords (think
123456orCompany2026!) against many accounts, staying under lockout thresholds. Defense: never use guessable passwords. - Online brute force hammers one account with many guesses. Defense: rate limiting and lockouts, which sites handle - It's the least effective of the three.
Stuffing is the standout because it defeats normal password quality advice. A 30-character masterpiece does nothing for you if it leaks from Site A and you also use it on Sites B through Z. Uniqueness, not strength, is the specific antidote.
How to make credential stuffing useless against you
The fix is structural, not behavioral vigilance. You can't out-monitor an attack that arrives as a single successful login from a residential IP.
One password per account, no exceptions
Unique credentials reduce any breach's blast radius to exactly one site. Since no human can memorize hundreds of unique strong passwords - NordPass research puts the average person's password count at around 168 personal logins - This practically requires a password manager. If you're on the fence, our password manager guide walks through the options; a browser-synced vault like our own Password Wallet is a fine starting point. For the accounts you type by hand, a passphrase generator produces memorable Diceware-style phrases that don't sacrifice strength.
Add a second factor to the accounts that matter
Two-factor authentication turns a valid stolen password into a failed login. Microsoft has reported that MFA blocks over 99.9% of automated account-compromise attacks - And credential stuffing is the definition of an automated attack. Start with email, banking and anything storing payment details - An authenticator app beats SMS codes wherever you get the choice.
Find out what's already leaked
Check your email address at haveibeenpwned.com, and run your current passwords through our password breach check to see if any already sit in a combo list. If an address appears in breaches, assume every password you used during those years is in a combo list somewhere and retire it everywhere it was ever used - Not just on the breached site. Our checklist on what to do after a data breach covers the full triage in order of urgency.
Reduce the linkability of your accounts
Stuffing keys on your email address. Using email aliases, or distinct handles from a username generator on forums and shopping sites, means a pair leaked from one service doesn't map cleanly onto your accounts elsewhere. It's a secondary defense, but it degrades the attacker's data quality for free.
What sites do about it (and why you can't rely on that)
Platforms fight stuffing with rate limiting, device fingerprinting, bot-detection and breached-password screening - NIST's guidance in SP 800-63B explicitly tells services to check new passwords against known-breached lists. Some large providers proactively reset accounts whose credentials surface in combo lists.
All of that helps, and none of it is dependable from your side of the screen. Proxy networks blunt rate limiting, human CAPTCHA farms defeat challenges, and smaller sites often have no defenses at all. The defense you control - Unique passwords plus a second factor - Is the one that works regardless of how competent any given website is.
FAQ
What's the difference between credential stuffing and a data breach?
A breach is the theft of credentials from one service; credential stuffing is the reuse of those stolen credentials against other services. The breach is the supply, stuffing is the distribution. You can be a stuffing victim on a site that was never itself breached.
How do attackers get my password in the first place?
Mostly from past breaches whose password databases were cracked or stored in plaintext, merged into combo lists that are sold or shared cheaply. Infostealer malware and phishing feed the same pipeline. Once a pair enters circulation it never really leaves - Lists from a decade ago are still being replayed today.
Is credential stuffing illegal?
Yes - Unauthorized access to accounts is a crime in essentially every jurisdiction (in the US, under the Computer Fraud and Abuse Act). That has little deterrent effect in practice, because the attacks are launched globally through proxy networks and attribution is difficult.
Will changing my password stop credential stuffing?
Changing the password on the breached account stops attacks on that account - But the pair keeps being replayed everywhere else forever. The lasting fix is making every account's password unique so there's nothing to replay, and adding 2FA so even a valid pair fails.
How do I know if my accounts are being stuffed?
Watch for login-alert emails from unfamiliar locations or devices, password-reset emails you didn't request, and lockout notices. Sudden loyalty-point or gift-card balance changes are classic signs of a quiet takeover. Any one of these means the credential pair is in circulation and every reuse of it should be retired the same day.