Automated attack using stolen username/password pairs from data breaches to access accounts on other services.
Credential stuffing uses automated tools to test stolen credentials from data breaches against many websites and services. Because people reuse passwords, credentials leaked from one breach often work elsewhere. Attackers obtain credential lists from dark web marketplaces, then use bots to attempt logins at scale. Successful logins lead to account takeover, fraud, or access to corporate systems. Credential stuffing differs from brute force—it uses known valid credentials rather than guessing passwords.
Why It Matters
The DSC Perspective:
Password reuse makes credential stuffing devastatingly effective. If an employee uses their work email and password on a compromised website, attackers may gain access to corporate systems. MFA blocks credential stuffing even when passwords are compromised.