Credential Stuffing Explained: Why Strong Passwords Alone Won’t Save You

Credential stuffing is the reason a strong password is not enough on its own. It is an automated attack. It takes usernames and passwords stolen from one breached website and fires them at the login pages of hundreds of others. The bet is simple: whoever owns that account reused the same details somewhere else. More often than not, they did.

That single fact changes how a business should think about login security. You can enforce sixteen-character passwords with symbols and numbers, yet a credential stuffing attack will still walk straight past that policy. The attacker is not guessing your password. They already have it, correctly, from a different service.

Why password policies do not solve this

Complexity rules were built to defeat brute force attacks, where a criminal has to guess a password from scratch. Against that threat, length and character variety genuinely help. They multiply the number of guesses required.

Credential stuffing sidesteps that defence entirely. Say an employee’s email password appeared in a breach at an online retailer three years ago, and they still use that same password for your company’s VPN. The strength of the password never comes into it. The attacker already has the correct answer.

This is why security teams treat password policy as necessary, not sufficient. It stops guessing attacks, though it does nothing about reuse.

What a credential stuffing attack looks like in practice

1. Attackers buy or trade a breach list. It can hold millions of email and password pairs, sourced from an unrelated hack.
2. They load the list into automation software built for this exact purpose. Tools such as OpenBullet can be pointed at almost any login form.
3. The tool spreads requests across thousands of residential proxy addresses. The traffic looks like ordinary users logging in from home, not one attacker hammering a single address.
4. Even a low success rate, often well under 1%, still returns hundreds or thousands of working logins from a large enough list.
5. Working accounts get sold, drained, or used as a way into a wider corporate network, when the account belongs to an employee rather than a customer.

None of this requires advanced hacking skill. Tools are free to download, breach lists are cheap, and the only real cost to the attacker is compute time.

How big is the problem, really?

Verizon’s 2025 Data Breach Investigations Report found stolen credentials were the initial access route in 22% of the breaches it analysed. Credential stuffing traffic made up a median 19% of all login attempts across the businesses studied. On some days that figure spiked above 40%.

The NCSC has issued its own advisory on the misuse of credential stuffing tools. It warns UK businesses of exactly this pattern: automated, distributed login attempts using genuinely stolen credentials, not guesswork.

Microsoft’s identity security research puts a number on the fix, not just the problem. Accounts protected by multi-factor authentication (MFA) are over 99.9% less likely to be compromised. A stolen password stops being enough on its own.

Who is actually running these attacks?

It is rarely a lone hacker guessing passwords at a keyboard. Most credential stuffing today is run by organised groups. They buy breach lists in bulk, rent proxy networks by the thousand, and treat the whole process as a numbers business. Some sell the working accounts they find. Others use them as a starting point for something bigger, since a compromised employee login can be the first foothold into a much wider network.

So that is worth remembering if your business assumes it is too small to bother with. The attacker is not choosing you specifically. They are running the same list against thousands of login pages at once and keeping whatever works.

What actually works instead

If password strength will not stop this, what will? A short list of controls does most of the work.

• MFA, enforced everywhere. This single change removes almost all the value of a stolen password. It should be non-negotiable for admin accounts, email and remote access.
• Breached password checks at signup and reset. Free tools like the Pwned Passwords API reject a password the moment someone tries to set one that has already leaked publicly.
• Login monitoring that looks for the right pattern. Do not just watch for repeated failures on one account, which stuffing avoids. Watch for a wide spread of usernames failing from an unusual mix of addresses in a short window.
• Bot mitigation on the login form. A CAPTCHA or behavioural challenge raises the cost of automation, even though a determined attacker can work around a basic one eventually.
• Notify users of new logins. A quick alert when an account signs in from an unrecognised device turns a silent compromise into a reported one.

Each of these helps. None of them is complete alone. That is the same conclusion the NCSC and OWASP both reach: layer several defences rather than betting everything on one.

What happens when this goes wrong: 23andMe

The genetic testing company 23andMe found this out the expensive way. Between April and September 2023, an attacker fed stolen username and password pairs into its login page. The pairs came from breaches at other companies. Around 14,000 accounts were compromised directly. Many belonged to users who had opted into a family-matching feature, which exposed data connected to millions of other people.

The UK’s Information Commissioner’s Office investigated. In June 2025 it fined the company £2.31 million, after establishing that 155,592 UK residents had their data accessed. Its findings read like a checklist of what not to do: no mandatory MFA, weak password requirements, and monitoring that missed a five-month attack while it was happening.

Every one of those gaps is fixable. Still, none of the fixes are expensive.

Finding out where you actually stand

Most businesses do not know how their own login pages would hold up until something goes wrong. A penetration test can answer that question safely, before an attacker does it for real. Testing typically checks three things: whether MFA is genuinely enforced on every route into an account, not just the main login screen; whether account lockout and rate limiting trigger before an attacker gets useful results; and what a compromised account can actually reach once an attacker is inside.

Aardwolf Security runs scoped penetration tests and authentication reviews for UK businesses. If your login controls have never been tested against this specific attack, it is worth getting in touch to talk through a scope that fits your systems.

Frequently asked questions

If I already require strong passwords, am I still at risk?

Yes. Password strength rules do not stop credential stuffing, because the attacker already has a valid password from another breach. The fix is reducing password reuse and adding MFA, not making passwords longer.

Do password managers help against credential stuffing?

Indirectly, yes. A password manager makes it easy to use a unique password for every account. A breach at one site then cannot be reused successfully against another.

What is the difference between credential stuffing and password spraying?

Credential stuffing uses real, previously breached username and password pairs. Password spraying uses no stolen credentials at all. It tries one common password against many different accounts, to avoid lockouts.

Should small businesses worry about this, or only large enterprises?

Attackers do not target by company size. Instead, they target by opportunity. Automated tools cost almost nothing to run against thousands of sites at once, so a small business with weak login controls is just as reachable as a large one.

Is multi-factor authentication enough on its own?

It removes most of the risk from credential stuffing specifically, though no single control is absolute. Attackers have found ways around it too, such as the session-hijacking technique used in the Kratos phishing kit. That is why MFA works best alongside breached password checks and login monitoring, not as the only line of defence.