In one sentence: Credential stuffing is when attackers take email and password pairs stolen from one breach and automatically try them on other sites, hoping you reused the password.

What it is

OWASP defines credential stuffing as the automated injection of stolen username and password pairs into website login forms, to fraudulently gain access to user accounts. Because many people reuse the same password, credentials exposed in one breach can unlock accounts elsewhere.

It differs from guessing. OWASP’s automated threats project notes that credential stuffing involves no brute-forcing or guessing of values. The attacker already holds real passwords and is simply checking where they work.

How it works

1. The attacker obtains lists of credentials from breaches, phishing or password dump sites. OWASP notes they can also be bought in criminal marketplaces.
2. Automated tools test the pairs against many sites, such as social media, shops or business web apps.
3. Each success confirms a valid login. OWASP lists what follows: draining stored value, accessing sensitive information, sending phishing from the account, or selling the valid logins on.
4. The attacker tries to avoid defences. OWASP notes CAPTCHA can be broken and that blocking IP addresses alone is easy to get around.

OWASP also warns that breach data can be used to reset passwords, particularly for business accounts, even where the password was not reused.

Who it affects and how badly

Any organisation with a login page, and any person who reuses passwords. That includes staff logging in to Microsoft 365, Google Workspace, VPNs and line-of-business apps, and customers logging in to your site.

Small firms are hit through staff using work emails on other sites. Retailers, hospitality and SaaS firms with customer accounts see automated login floods. Accountancy and recruitment firms hold documents behind a single password. Healthcare, fintech and insurers face regulator action if customer accounts are taken over. Worst case is account takeover at scale, data theft, and a regulator asking why MFA was not required.

Real examples

23andMe, 2023. The ICO says that between April and September 2023 a hacker carried out a credential stuffing attack using reused login credentials stolen from unrelated breaches, accessing personal information of 155,592 UK residents, including names, birth years, location, ethnicity, family trees and health reports. The ICO fined the company £2.31 million for failing to put appropriate security measures in place, and said the warning signs were there and the company was slow to respond. Sources: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/ and https://ico-newsroom.prgloo.com/news/ico-fines-23andme-gbp-2-31-million-for-failing-to-protect-uk-users-genetic-data

How to detect it

• Look for spikes in failed logins, many different usernames from one source, or many sources trying a few usernames each. OWASP notes attackers use many IP addresses to look like normal traffic.
• Watch for a spike in successful logins, which the ICO noted in the 23andMe case, and for logins from unusual countries or hosting providers.
• In Microsoft Entra, review sign-in logs and risky sign-ins. In Google Workspace, review login audit logs and alerts.
• Check staff email addresses against known breaches so you know which passwords are likely in attacker lists.
• Listen to warnings. Messages that your data is for sale should trigger an investigation.

How to fix or prevent it

1. Require MFA for every account that supports it. OWASP calls MFA by far the best defence, and the ICO recommends it, particularly where sensitive personal information is processed.
2. Block breached and common passwords at sign-up and password change, and encourage password managers.
3. Do not force routine password changes unless you suspect a breach, in line with OWASP’s reference to NIST 800-63b.
4. Rate limit and add bot defences to login pages, treating CAPTCHA and IP blocking as extras, not the main control.
5. Use unique, non-guessable usernames where you can.
6. Log failures and alert on spikes.
7. Check your staff addresses in breach data and reset exposed passwords.

Related terms

• password spraying
• brute force attack
• multi-factor authentication
• phishing-resistant MFA
• infostealer malware
• personal data breach and the ICO 72-hour rule

Browse all entries in the credentials and exposure hub.

FAQ

How is credential stuffing different from brute force? Brute force guesses passwords. Credential stuffing uses real stolen username and password pairs from other breaches.

What is the best defence? OWASP says multi-factor authentication.

Has it led to a fine? Yes. The ICO fined 23andMe £2.31 million after a credential stuffing attack.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy.