Credential stuffing is an attack where criminals take username and password pairs stolen from one site and try them automatically on many others. It works because people reuse passwords. If your login details leaked from a forum in 2019 and you use the same pair for your email today, an attacker’s script will find that out in seconds. This guide explains how the attack runs, how to spot it, and which defences actually reduce the risk.
Table of Contents
How does credential stuffing work?
The UK’s National Cyber Security Centre (NCSC) describes the attack as one that “takes advantage of people reusing username and password combinations”. The NCSC also says the primary motivation is financial, although it can lead to identity theft too.
The process is simple and cheap to run:
- An attacker gets a list of leaked logins, usually from an earlier breach of an unrelated service.
- They load the list into a tool that tries each pair against the login page of a target site.
- Every pair that works is a real account, which the attacker can use, sell or empty.
The attacker never has to guess anything. Every password in the list was real once, and a good share of them are still live somewhere else. That is why the hit rate can be low and the attack still pays: a tiny percentage of millions of attempts is still a lot of accounts.
How is it different from brute force and password spraying?
The three attacks get confused a lot, and the defences differ slightly. The OWASP cheat sheet on this topic separates them like this:
| Attack | What the attacker tries |
|---|---|
| Brute force | Many passwords against one account |
| Credential stuffing | Leaked username and password pairs from another site |
| Password spraying | One weak password against many accounts |
Stuffing is the hardest of the three to catch. Each login uses a real, correct password, so the request looks much like a normal one. Nothing about it is a guess, which also means lockout rules based on failed attempts can miss it.
Why does it work so well against businesses?
Staff are people, and people reuse passwords. The NCSC puts it plainly in its password guidance: attackers use passwords leaked from breaches against other systems, so one compromised password can open several accounts.
For a business, that creates a gap you cannot see. A member of staff signs up to a third-party service with their work email. That service gets breached. Months later the same pair is tried against your VPN, your Microsoft 365 tenant or your customer portal. Your own systems were never breached, yet an attacker is now logged in.
We have written about a real case of this pattern, where stolen staff passwords went unnoticed for seven weeks at a national tax agency. Valid credentials are quiet. Nothing trips an alarm until someone looks at the logs.
How can you tell if you are being targeted?
You will rarely get a single clear alert. Look for patterns across your authentication logs:
- A sudden rise in login attempts, especially from many different IP addresses.
- Lots of failed logins for accounts that do not exist, which suggests a list of emails is being tried.
- Successful logins from unusual countries, new devices or odd hours.
- Users reporting password reset emails they did not ask for.
OWASP warns that low-volume traffic spread over many IP addresses is part of the picture. Attackers use proxy networks so that no single address looks noisy. A defence that only counts attempts per IP will miss this, so measure attempts per account and per time window as well.
What is the best defence against credential stuffing?
Multi-factor authentication (MFA) is the strongest single control. OWASP calls it the strongest defence against these attacks and cites Microsoft analysis suggesting it would have stopped 99.9% of account compromises. A stolen password is no use if the attacker cannot also provide the second factor. The NCSC adds that single sign-on should require MFA, because one compromised login could otherwise expose many services.
MFA is not perfect, since weaker forms can be bypassed. Our piece on what MFA stops and what still gets through covers the gaps and gives a rollout checklist.
MFA should sit alongside other layers against credential stuffing. OWASP recommends layering defences rather than relying on one.
Check new passwords against known breaches
Stop people choosing passwords that are already in circulation. The free Pwned Passwords service from Have I Been Pwned holds hundreds of millions of passwords exposed in breaches. Its range search uses k-anonymity: your system hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns matching hash suffixes, and your code checks locally whether the full hash is in the list. The password itself never leaves your system.
Throttle logins instead of locking accounts
The NCSC says throttling is preferred, because lockout can leave legitimate users unable to get into their accounts. Throttling adds a longer delay after each failed attempt. If you do use lockout, the NCSC suggests allowing 5 to 10 attempts first. Lockout can also be abused to lock your staff out on purpose.
Add friction for bots
OWASP lists several ways to slow automated tools. A CAPTCHA on suspicious logins helps, though it is not foolproof. Device fingerprinting can trigger extra checks when a login does not match the usual device. Splitting login into steps also adds work for scripts. None of these is a complete answer, and OWASP says fingerprinting should not be your only defence because client data can be faked.
Do not rely on blocking IP addresses
Blocking by IP alone is easy to get around, according to OWASP. Use graduated responses, keep blocks temporary, and think about the type of IP address (home broadband or hosting provider) when you set thresholds.
Tell users when something looks wrong
OWASP suggests alerting a user when a correct password fails the MFA step, since that is a strong sign their password has leaked. It advises against alerts for every routine wrong password, which only causes alert fatigue. Showing recent login history lets users spot sessions they do not recognise.
What should staff do?
You cannot control every site your staff use, so give them habits that limit the damage.
- Use a different password for every account. The NCSC recommends password managers, which also generate strong passwords and fill them in.
- Turn on MFA for email, banking, cloud services and anything that holds company data.
- Keep work email addresses off personal sign-ups where you can.
- Change a password straight away if a service tells you it was breached.
The NCSC also advises that online services should allow pasting into password fields, so that password managers work properly.
How can a penetration test help?
A policy on paper does not tell you whether your login pages hold up under a real attack. A penetration tester can try the same techniques an attacker uses against your login pages, VPN and cloud sign-in. They check whether throttling really kicks in, whether MFA can be skipped, and whether your logs would show it happening.
If you want that checked, our penetration testing service covers authentication testing, and you can get in touch to talk through a scope. Either way, the steps above are worth doing first.
Credential stuffing FAQ
Is credential stuffing illegal?
Yes. Using stolen logins to access accounts without permission is unauthorised access, and it is a crime in the UK. Security teams can test their own systems with permission, which is what a scoped penetration test does.
Does a strong password protect me?
Only if it is unique. A long, complex password that you also use on a breached site is as good as public, because the attacker already has the exact text.
Can credential stuffing hit accounts that use MFA?
The password part of the attack still works, but the attacker is stopped at the second step. Some forms of MFA are easier to bypass than others, so the type you choose matters.
How do I check if my details have leaked?
Search your email address on Have I Been Pwned, then change any password you reused on the affected sites.
Should we lock accounts after a few failed logins?
Throttling is the NCSC’s preferred approach. If you choose lockout, allow 5 to 10 attempts and monitor for lockouts that look deliberate.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
