Cyberpediaby Brain
ENDEFR

Credential stuffing

Passwords stolen in a data breach are tried by bots on other services. How the attack works and how to protect yourself.

In 30 seconds

Where it happens
On any service with a login form, including mailboxes, the company's online applications and single sign-on portals12.
What the attacker wants
To find, among stolen credential pairs, the ones that open a real account, counting on password reuse12.
The reflex
A different password for each service, kept in a password manager, with two-factor authentication when it exists56.
If it has already happened
Change the affected password without delay5.

What it is

Credential stuffing, called "réinjection d'identifiants" in French, means taking username and password pairs stolen in a data breach and trying them automatically on other sites. OWASP describes it as the automated injection of these pairs into login forms, to gain fraudulent access to accounts1.

An employee does not have to make any mistake to be hit: their account was not attacked directly. It is enough that a password used on a minor site is also used elsewhere, for example on the work mailbox.

Straight answers

How is it different from brute force?

Brute force tries several passwords against one or more accounts: the attacker guesses. Credential stuffing uses pairs that are already known, taken from a breach, against other sites1. OWASP classes it as a subset of brute force, and MITRE makes it sub-technique T1110.004 of the "Brute Force" technique12.

Why does it work?

Because many people reuse the same password and the same username or email address. When this data is exposed, submitting it to dozens or hundreds of other sites can be enough to compromise accounts there1. MITRE adds that reuse affects personal and work accounts alike2.

My password is long and complex: am I safe?

No, if it is used in several places. According to CISA, reusing a password, even a strong one, puts accounts at risk as much as a weak password does7. Length protects against guessing, not against the reuse of a password that has already been stolen.

Is a reused password the only way in?

No. OWASP points out that breach data is also used to reset passwords, especially for corporate accounts: security questions, recovery addresses or other personal information contained in the breach then allow a takeover even without reuse1.

Can a hijacked account be used for something else?

Yes. A valid account lets someone enter the network without malware, which makes the attacker's presence harder to spot4.

1Inside the attacker's head1 min

The attacker starts by getting hold of credentials: a site breach, phishing or a password dump site1. They do not need to have a grudge against a particular person. CISA notes that an attack often does not target a specific account, but the access it gives to launch a broader attack7.

They then hand these pairs to automatic tools, which try them on many sites: social networks, online shops, web applications1. A successful login tells them they hold valid credentials1.

What remains is to make use of them. OWASP lists four possible follow-ups: draining accounts of their stored value or making purchases, reading sensitive information (card numbers, private messages, documents), sending phishing messages or spam from the account, and reselling the valid credentials to other attackers1.

MITRE stresses that this method can cause many authentication failures and account lockouts, depending on the targeted organization's policy2. Defenders, for their part, can block risky login requests, such as those coming through anonymization services or proxies2.

2What you see on screen1 min

The victim rarely sees the attack itself. They see its effects, and these vary with what the attacker has decided to do with the account.

  • A message from the service reporting a login from an unknown device. The CNIL describes this case: the site warns by SMS or email, and the person can allow or refuse the access6.
  • A locked account, after many failed logins. MITRE mentions these lockouts as a possible consequence2.
  • Purchases, messages or documents affected that the account holder did not make or send, since these are the uses OWASP describes1.
  • A password reset email that nobody asked for. Cybermalveillance.gouv.fr explains why mailboxes are targeted: they receive the reset links for other accounts, and whoever breaks into one can use the "forgotten password" function to take over, for example, a bank account5.

None of these situations proves a credential stuffing attack on its own. All of them justify changing the password and informing the IT department if the account is a work account.

3Under the hoodIT teams1 min

OWASP illustrates the mechanism with a diagram: the database of a site, acme.com, is compromised. The attacker tries these credentials on three other sites. They find that one user, "spongebob", reuses his password on two sites and that one user, "sally", reuses hers on one site: three accounts are opened1.

The targets are not limited to consumer sites. MITRE lists administration services on common ports (SSH, RDP, SMB, LDAP, databases), but also single sign-on, cloud applications built on federated protocols and exposed mail services such as Office 3652. On the detection side, MITRE describes typical signals: many failures with different pairs from one IP address in a short time, or failures on cloud applications with pairs coming from unrelated domains2.

Another technical point: when an attacker knows the right password but runs into an access rule based on location, they can change infrastructure to match the victim's location and bypass the rule3.

The defenses on the organization's side, according to MITRE: lock accounts after a number of failures (a rule that is too strict can block legitimate accounts), require multifactor authentication, proactively reset accounts known to appear in breaches2. OWASP names multifactor authentication as the main countermeasure1.

4What you do1 min
  • A different password for each service. That way, if one is stolen, only the affected service is vulnerable5. The CNIL asks for a separate, unique password for each sensitive account (bank, mailbox, social network) to avoid cascading hacks6.
  • A password manager, which remembers long and all-different passwords for you6. Cybermalveillance.gouv.fr cites KeePassXC, certified by ANSSI in version 2.7.95. The manager's master password must itself be strong7.
  • Two-factor authentication when the service offers it: in addition to the password, a confirmation by code, app, key or biometrics means that only you authorize a new device5.
  • An immediate change at the slightest suspicion, or as soon as you learn that a company where you have an account has been hacked, without waiting to find out whether it is true5.
  • A particularly strong mailbox password, since it opens the reset of many other accounts5.

The UK NCSC also states, in a news item of 23 April 2026, that passkeys are a safer and simpler way to sign in, and should be the default option for individuals8.

5Pitfalls1 min
  • Believing that an "unimportant" account does not matter. A password stolen from a secondary site is tried elsewhere1.
  • Memorizing a single good password and reusing it unchanged. That is reuse7.
  • Keeping passwords on a sticky note, in your mailbox, in an unprotected file or in the phone5.
  • Saving passwords in the browser of a shared computer6.
6Case filesReal cases1 min

OWASP collects breaches which, according to its analysis, resulted from credential stuffing. Here are four of them, as it reports them1.

Sony, 2011

An analyst finds that, among the users present in both Sony's data and the data of the Gawker breach earlier the same year, two thirds had the same password on both systems1.

Yahoo, 2012

OWASP cites Troy Hunt, who links the Sony and Yahoo breaches through one common point: the passwords1.

Dropbox, 2012

Dropbox stated that the usernames and passwords mentioned in the press had been stolen from other services, not from Dropbox. Attackers had then tried them on sites across the internet, including Dropbox1.

JPMorgan Chase, 2014

The breach data contained combinations of passwords and addresses of participants registered on the Corporate Challenge site, a platform for annual charity races run by an outside contractor, open to the bank's employees and those of other companies. OWASP specifies that this breach came from a separate source: attackers targeted a third-party race site to extract credentials to use against JPMC1.

Fact sheet

Identifier
CP-036
Wing
1. Attacks and techniques
Brain skill
Mastering Passwords & MFA (master_passwords)
Brain reflex
cr-008
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. OWASP, “Credential stuffing | OWASP Foundation”. https://community.owasp.org/attacks/Credential_stuffing (accessed 3 November 2026)
  2. MITRE ATT&CK, “Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/004/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/ (accessed 3 November 2026)
  5. Cybermalveillance.gouv.fr, “Pourquoi et comment bien gérer ses mots de passe ?”, 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026)
  6. CNIL, “Les conseils de la CNIL pour un bon mot de passe”, 26 January 2017. https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe (accessed 3 November 2026)
  7. CISA, “Choosing and Protecting Passwords”, 21 May 2009. https://www.cisa.gov/news-events/news/choosing-and-protecting-passwords (accessed 3 November 2026)
  8. NCSC (UK), “Password administration for system owners”, 19 November 2018. https://www.ncsc.gov.uk/collection/passwords (accessed 3 November 2026)

Cite this article

Brain, “Credential stuffing”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/

BibTeX 
@misc{brain_cp036_en_2026,
  author = {Brain},
  title = {Credential stuffing},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/credential-stuffing-leaked-passwords/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence