Definition
Credential stuffing
In one sentence
Credential stuffing is an automated attack in which criminals take usernames and passwords leaked from one breach and try them on other services, exploiting people who reuse passwords.
Password sprayingPassword managerMulti-factor authenticationAccount takeover
Credential Stuffing Explained
Billions of username and password pairs from past breaches circulate online. Credential stuffing tools test them against login pages at scale, rotating through many IP addresses to avoid simple blocking. Because many people reuse passwords, a fraction of attempts succeed.
For businesses, credential stuffing threatens both staff accounts and customer accounts. A staff member who used the same password for a fitness app and their work VPN can hand an attacker remote access. An e-commerce site in Halifax may see customer accounts taken over and used for fraud.
Protections for staff accounts are straightforward: enforce MFA everywhere, use a password manager so every password is unique, and check passwords against known breached lists, which Microsoft Entra ID password protection supports. For customer-facing sites, add bot detection, rate limiting, MFA options for customers and monitoring for spikes in failed logins.
Credential stuffing differs from password spraying, which tries a few common passwords against many accounts, though both are stopped largely by the same controls.
General information for Canadian organizations, not legal advice.