Credential Stuffing

Layer 7: Application High risk

How it works

Billions of username and password combinations from past data breaches circulate among criminals. Credential stuffing uses automated tools to try those pairs against other services, such as Microsoft 365, VPNs, banking portals, payroll systems and online stores. The attack works because many people reuse the same password, or a minor variation, across personal and work accounts. Lists of stolen credentials are cheap and easy to obtain, so attackers can test millions of combinations with very little effort or cost.

Attackers spread attempts across many IP addresses to avoid simple blocking, so the activity can look like ordinary failed logins. When a combination works, the account is either used directly or sold. For a business, a single reused password from an employee's old personal account can lead straight into company email or customer data. Customer-facing portals are also targets, and takeovers there can lead to fraud, complaints and reputational harm.

Warning signs

• Spikes in failed login attempts across many accounts
• Successful sign-ins from unfamiliar locations
• Customers reporting account takeovers on your portal
• Accounts locked out without the user trying to sign in
• Login traffic from known proxy or hosting networks

How to defend against it

• Require multi-factor authentication on all external services
• Provide a business password manager to stop reuse
• Screen new passwords against known breached lists
• Monitor for company credentials in breach data
• Use rate limiting and bot detection on customer logins

If it happens to you

1. Force password resets for affected accounts
2. Revoke sessions and confirm MFA is enforced
3. Review accessed data to judge breach notification needs
4. Block the source infrastructure where practical