What Is Credential Stuffing?
Definition
Credential stuffing is an automated attack in which criminals take username and password pairs stolen in one breach and try them on many other websites. It works because people reuse passwords. OWASP describes it as "the automated injection of stolen username and password pairs ('credentials') in to website login forms."
How It Works
OWASP lays out the anatomy:
- Get the lists. The attacker collects credentials from earlier website breaches, phishing, or password dump sites.
- Automate the logins. Tools test each pair against many sites, such as email providers, online stores, banks, and web apps.
- Keep the hits. Each successful login confirms a working account.
- Cash in. Attackers drain stored value, make purchases, read private data, send phishing from the account, or sell the confirmed logins.
OWASP treats credential stuffing as a subset of brute force, with a key difference: brute force guesses passwords, while credential stuffing uses known, already-breached pairs. That is why it succeeds against strong but reused passwords.
The defenses are well established. OWASP names multi-factor authentication as a primary countermeasure. NIST SP 800-63B-4 requires services to check new passwords against a blocklist of commonly used, expected, or compromised values, which stops users from choosing a password already circulating in breach lists.
Real-World Example
On June 17, 2025, the UK Information Commissioner's Office fined 23andMe £2.31 million. The ICO found that between April and September 2023, a hacker carried out a credential stuffing attack on 23andMe's platform, "exploiting reused login credentials that were stolen from previous unrelated data breaches," which led to unauthorized access to personal information belonging to 155,592 UK residents. The joint investigation with Canada's Privacy Commissioner found the company failed to implement appropriate authentication measures, such as mandatory multi-factor authentication, secure password protocols, or unpredictable usernames. The ICO also found the response inadequate: a full investigation did not begin until October 2023.
Why It Matters for a Small Business
Your staff's passwords from unrelated breaches (a shopping site, a forum) can be tried against your Microsoft 365, payroll, or WordPress login. Verizon's 2026 Data Breach Investigations Report found credential abuse was the initial access vector in 13% of small and medium business breaches. The 23andMe case also shows regulators treating missing MFA as a security failure, not bad luck, when customer data is exposed. The ICO also faulted 23andMe for lacking effective systems to monitor, detect, or respond to the attack, and for dismissing an August 2023 claim of data theft as a hoax.
How to Spot It / How DTS Handles It
Signs: bursts of failed logins across many usernames; successful logins from unfamiliar countries or hosting providers; password reset emails nobody requested; and users locked out together.
DTS can help with enforcing MFA, blocking breached passwords, setting sign-in risk policies and rate limits, and reviewing login logs after any spike. See our business email compromise response page for what happens when a stuffed mailbox is used for fraud.
Related Terms
- Multi-factor authentication (MFA): the primary countermeasure OWASP recommends.
- Account takeover: what a successful stuffed login becomes.
- Password spraying: a related attack that tries common passwords instead of stolen pairs.
- Password manager: makes unique passwords practical.
- Brute force attack: the broader attack category.
- Infostealer: malware that feeds stolen credentials into these lists.
Sources
- OWASP, Credential stuffing: https://owasp.org/www-community/attacks/Credential_stuffing
- NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025): https://csrc.nist.gov/pubs/sp/800/63/b/4/final
- UK Information Commissioner's Office, 23andMe fined £2.31 million for failing to protect UK users' genetic data (June 17, 2025): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/
- Verizon, 2026 Data Breach Investigations Report (SMB focused analysis): https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf
Last updated October 14, 2026.