--- id: CP-036 slug: credential-stuffing-leaked-passwords lang: en title: Credential stuffing description: Passwords stolen in a data breach are tried by bots on other services. How the attack works and how to protect yourself. canonical_url: https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/ markdown_url: https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Credential stuffing", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/ (CC BY 4.0) wing: 1 theme: master_passwords reflex: cr-008 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/ fr: https://startbrain.io/cyberpedia/fr/articles/credential-stuffing-reinjection-identifiants/ de: https://startbrain.io/cyberpedia/de/articles/credential-stuffing-wiederverwendete-zugangsdaten/ es: https://startbrain.io/cyberpedia/es/articles/credential-stuffing-reutilizacion-credenciales/ sources: - "n": 1 title: Credential stuffing | OWASP Foundation publisher: OWASP url: https://community.owasp.org/attacks/Credential_stuffing accessed: "2026-11-03" - "n": 2 title: "Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/004/ accessed: "2026-11-03" - "n": 3 title: Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/ accessed: "2026-11-03" - "n": 4 title: Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1078/ accessed: "2026-11-03" - "n": 5 title: Pourquoi et comment bien gérer ses mots de passe ? publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe published: "2019-11-23" accessed: "2026-11-03" - "n": 6 title: Les conseils de la CNIL pour un bon mot de passe publisher: CNIL url: https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe published: "2017-01-26" accessed: "2026-11-03" - "n": 7 title: Choosing and Protecting Passwords publisher: CISA url: https://www.cisa.gov/news-events/news/choosing-and-protecting-passwords published: "2009-05-21" accessed: "2026-11-03" - "n": 8 title: Password administration for system owners publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/passwords published: "2018-11-19" accessed: "2026-11-03" --- # Credential stuffing Credential stuffing, called "réinjection d'identifiants" in French, means taking username and password pairs stolen in a data breach and trying them automatically on other sites. OWASP describes it as the automated injection of these pairs into login forms, to gain fraudulent access to accounts [1]. An employee does not have to make any mistake to be hit: their account was not attacked directly. It is enough that a password used on a minor site is also used elsewhere, for example on the work mailbox. ## In 30 seconds - Where it happens: on any service with a login form, including mailboxes, the company's online applications and single sign-on portals [1][2]. - What the attacker wants: to find, among stolen credential pairs, the ones that open a real account, counting on password reuse [1][2]. - The reflex: a different password for each service, kept in a password manager, with two-factor authentication when it exists [5][6]. - If it has already happened: change the affected password without delay [5]. ## Straight answers ### How is it different from brute force? Brute force tries several passwords against one or more accounts: the attacker guesses. Credential stuffing uses pairs that are already known, taken from a breach, against other sites [1]. OWASP classes it as a subset of brute force, and MITRE makes it sub-technique T1110.004 of the "Brute Force" technique [1][2]. ### Why does it work? Because many people reuse the same password and the same username or email address. When this data is exposed, submitting it to dozens or hundreds of other sites can be enough to compromise accounts there [1]. MITRE adds that reuse affects personal and work accounts alike [2]. ### My password is long and complex: am I safe? No, if it is used in several places. According to CISA, reusing a password, even a strong one, puts accounts at risk as much as a weak password does [7]. Length protects against guessing, not against the reuse of a password that has already been stolen. ### Is a reused password the only way in? No. OWASP points out that breach data is also used to reset passwords, especially for corporate accounts: security questions, recovery addresses or other personal information contained in the breach then allow a takeover even without reuse [1]. ### Can a hijacked account be used for something else? Yes. A valid account lets someone enter the network without malware, which makes the attacker's presence harder to spot [4]. ## Inside the attacker's head The attacker starts by getting hold of credentials: a site breach, phishing or a password dump site [1]. They do not need to have a grudge against a particular person. CISA notes that an attack often does not target a specific account, but the access it gives to launch a broader attack [7]. They then hand these pairs to automatic tools, which try them on many sites: social networks, online shops, web applications [1]. A successful login tells them they hold valid credentials [1]. What remains is to make use of them. OWASP lists four possible follow-ups: draining accounts of their stored value or making purchases, reading sensitive information (card numbers, private messages, documents), sending phishing messages or spam from the account, and reselling the valid credentials to other attackers [1]. MITRE stresses that this method can cause many authentication failures and account lockouts, depending on the targeted organization's policy [2]. Defenders, for their part, can block risky login requests, such as those coming through anonymization services or proxies [2]. ## What you see on screen The victim rarely sees the attack itself. They see its effects, and these vary with what the attacker has decided to do with the account. - A message from the service reporting a login from an unknown device. The CNIL describes this case: the site warns by SMS or email, and the person can allow or refuse the access [6]. - A locked account, after many failed logins. MITRE mentions these lockouts as a possible consequence [2]. - Purchases, messages or documents affected that the account holder did not make or send, since these are the uses OWASP describes [1]. - A password reset email that nobody asked for. Cybermalveillance.gouv.fr explains why mailboxes are targeted: they receive the reset links for other accounts, and whoever breaks into one can use the "forgotten password" function to take over, for example, a bank account [5]. None of these situations proves a credential stuffing attack on its own. All of them justify changing the password and informing the IT department if the account is a work account. ## Under the hood OWASP illustrates the mechanism with a diagram: the database of a site, acme.com, is compromised. The attacker tries these credentials on three other sites. They find that one user, "spongebob", reuses his password on two sites and that one user, "sally", reuses hers on one site: three accounts are opened [1]. The targets are not limited to consumer sites. MITRE lists administration services on common ports (SSH, RDP, SMB, LDAP, databases), but also single sign-on, cloud applications built on federated protocols and exposed mail services such as Office 365 [2]. On the detection side, MITRE describes typical signals: many failures with different pairs from one IP address in a short time, or failures on cloud applications with pairs coming from unrelated domains [2]. Another technical point: when an attacker knows the right password but runs into an access rule based on location, they can change infrastructure to match the victim's location and bypass the rule [3]. The defenses on the organization's side, according to MITRE: lock accounts after a number of failures (a rule that is too strict can block legitimate accounts), require multifactor authentication, proactively reset accounts known to appear in breaches [2]. OWASP names multifactor authentication as the main countermeasure [1]. ## What you do - A different password for each service. That way, if one is stolen, only the affected service is vulnerable [5]. The CNIL asks for a separate, unique password for each sensitive account (bank, mailbox, social network) to avoid cascading hacks [6]. - A password manager, which remembers long and all-different passwords for you [6]. Cybermalveillance.gouv.fr cites KeePassXC, certified by ANSSI in version 2.7.9 [5]. The manager's master password must itself be strong [7]. - Two-factor authentication when the service offers it: in addition to the password, a confirmation by code, app, key or biometrics means that only you authorize a new device [5]. - An immediate change at the slightest suspicion, or as soon as you learn that a company where you have an account has been hacked, without waiting to find out whether it is true [5]. - A particularly strong mailbox password, since it opens the reset of many other accounts [5]. The UK NCSC also states, in a news item of 23 April 2026, that passkeys are a safer and simpler way to sign in, and should be the default option for individuals [8]. ## Pitfalls - Believing that an "unimportant" account does not matter. A password stolen from a secondary site is tried elsewhere [1]. - Memorizing a single good password and reusing it unchanged. That is reuse [7]. - Keeping passwords on a sticky note, in your mailbox, in an unprotected file or in the phone [5]. - Saving passwords in the browser of a shared computer [6]. ## Case files OWASP collects breaches which, according to its analysis, resulted from credential stuffing. Here are four of them, as it reports them [1]. ### Sony, 2011 An analyst finds that, among the users present in both Sony's data and the data of the Gawker breach earlier the same year, two thirds had the same password on both systems [1]. ### Yahoo, 2012 OWASP cites Troy Hunt, who links the Sony and Yahoo breaches through one common point: the passwords [1]. ### Dropbox, 2012 Dropbox stated that the usernames and passwords mentioned in the press had been stolen from other services, not from Dropbox. Attackers had then tried them on sites across the internet, including Dropbox [1]. ### JPMorgan Chase, 2014 The breach data contained combinations of passwords and addresses of participants registered on the Corporate Challenge site, a platform for annual charity races run by an outside contractor, open to the bank's employees and those of other companies. OWASP specifies that this breach came from a separate source: attackers targeted a third-party race site to extract credentials to use against JPMC [1]. ## Sources 1. OWASP, "Credential stuffing | OWASP Foundation". https://community.owasp.org/attacks/Credential_stuffing (accessed 3 November 2026) 2. MITRE ATT&CK, "Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/004/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1078/ (accessed 3 November 2026) 5. Cybermalveillance.gouv.fr, "Pourquoi et comment bien gérer ses mots de passe ?", 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026) 6. CNIL, "Les conseils de la CNIL pour un bon mot de passe", 26 January 2017. https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe (accessed 3 November 2026) 7. CISA, "Choosing and Protecting Passwords", 21 May 2009. https://www.cisa.gov/news-events/news/choosing-and-protecting-passwords (accessed 3 November 2026) 8. NCSC (UK), "Password administration for system owners", 19 November 2018. https://www.ncsc.gov.uk/collection/passwords (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.