Back

Definition
Credential stuffing is a cyberattack where attackers use stolen username and password pairs to try logging in to other accounts. It relies on the fact that many people reuse the same credentials across different websites, apps, and services.

Why it matters
Credential stuffing matters because even strong systems can be targeted when users reuse compromised passwords. It can lead to account takeover, fraud, locked accounts, support issues, and large volumes of suspicious login traffic.

Example use case
A password list from an old data breach is used to test logins on a banking app. Some users reused the same password, so the attacker gains access unless the system detects the unusual login pattern or requires extra verification.