Credential stuffing

How does credential stuffing work?

Credential stuffing relies on people reusing the same password on more than one site. An attacker takes a list of username and password pairs from a past breach, then uses software to try each pair on other sites’ login pages. Any pair that works gives access to a real account. OWASP describes the attack as trying credential pairs that were stolen in a breach elsewhere, and treats it as distinct from brute force and password spraying.

Your own site does not need to have been breached. The leak happened elsewhere, and your login page is simply the next place the list is tried.

Why does credential stuffing matter for a small business?

A successful attempt looks like a normal login, so the first sign is often a customer complaint about a hijacked account, or a spike of failed logins in your logs. OWASP calls multi-factor authentication by far the best defence. It also recommends checking new passwords against breach data, and names the free Pwned Passwords service for that.

The practical steps, including rate limits and bot checks, are in the full guide: how to stop AI-driven login attacks.