Credential Stuffing
Credential Stuffing
An attack that automatically tries credentials leaked elsewhere to log into other services without authorization.
In Simple Terms
Credential stuffing is a cyberattack that uses login information leaked from another service to automatically attempt unauthorized logins elsewhere. It preys on the fact that many people reuse the same ID and password across multiple services. Attackers use specialized programs to try huge numbers of combinations at once, which lets the damage spread quickly.
Behind the Name
"Credential" means login information such as an ID and password, and "stuffing" means cramming something in. The name comes from how attackers take a list of IDs and passwords obtained elsewhere and automatically try each one, one after another — like jamming key after key into a lock.
Take a Closer Look!
Credential stuffing is a cyberattack that uses ID and password combinations leaked from one service to automatically attempt unauthorized logins on other websites or apps.
Attackers take a list of login information they've obtained and feed it in one after another using a computer program.
Put simply, it's an attack that targets password reuse.
Since many people tend to reuse the same ID and password across multiple sites, a leak from just one site can put other services at risk of being broken into as well.
Rather than typing manually, attackers use specialized tools that can attempt dozens of logins per second, which lets the damage spread rapidly.
To defend against this attack, it helps to set a different password for each service and to add two-step verification, which requires an extra confirmation code at login.
Keeping each password different means that even if information leaks from one place, the risk of other accounts being taken over as well is reduced.