Credential Stuffing Explained: How One Data Breach Becomes Your Problem

Here's a strange thing about modern account takeovers: very often nobody guesses your password. Nobody hacks your bank, or your streaming service, or your shopping account either. They simply log in. They have the right email address and the right password, because you gave them both, years ago, to a completely different website.

That's the whole idea behind credential stuffing. It's dull, automated, and astonishingly effective, and it turns a breach somewhere you barely remember into a problem at the places you use every day. Understanding how it works makes the defence obvious.

A made-up but typical week

To see how it unfolds, imagine a perfectly ordinary scenario. None of the details are real, but every step matches how these attacks are generally described.

What credential stuffing actually is

The term comes from "stuffing" lists of stolen credentials, meaning email and password pairs, into login forms until some of them fit. A bot does the typing. It tries each pair on a site, notes which ones succeed, and keeps those.

It helps to contrast it with its better-known cousin. Classic brute force guesses passwords, trying one combination after another against a single account. Credential stuffing doesn't guess anything. It uses real pairs that already worked somewhere. That makes each attempt look far more like a legitimate login, and it's why the whole trick depends on one human habit: reusing passwords.

Why a tiny success rate is plenty

Commonly cited estimates put the success rate of credential stuffing at somewhere between about 0.1 and 2 percent of attempts. That sounds hopeless, until you do the arithmetic. As a simple illustration, suppose an attacker tries a million pairs and one percent work. That's ten thousand accounts, from a few hours of automated effort and a list that cost very little to obtain.

The attackers also have ways of staying under the radar. Reports describe bots spreading their attempts across large pools of proxy addresses, including ones that look like ordinary home connections, which makes blocking by internet address a losing game. And because each pair is tried only once or twice per site, nothing looks like a sustained attack on any single account.

It isn't theoretical: the 23andMe case

In October 2023, the genetic testing company 23andMe announced that attackers had used credential stuffing against its customers' accounts. According to the company, about 14,000 accounts were accessed directly, less than one percent of its customer base. That sounds contained until you see what came next.

Many of those accounts had opted in to features that let relatives find and connect with each other, such as DNA Relatives and Family Tree. By getting into a relatively small number of accounts, the attackers were able to scrape information about far more people. The company later said the data of about 6.9 million people had been affected, including roughly 5.5 million through DNA Relatives profiles and about 1.4 million through Family Tree profiles. Genetic and ancestry data is about as personal as information gets.

The aftermath was contentious. In early 2024 the company argued that customers had reused passwords from other incidents and failed to update them, a stance that drew criticism. It has since made two-step verification mandatory, and in 2024 it agreed to a $30 million settlement of the US class actions. The honest reading is that both things are true: people who reuse passwords make this attack possible, and companies that don't offer or require stronger protection make it easy.

How common is it?

More common than most people assume. In its 2025 report, Verizon analysed logs from single sign-on providers and found that credential stuffing made up a median of 19 percent of daily login attempts across the organisations studied. Even small organisations saw about 12 percent, and on the worst single day in the data the figure reached 44 percent. In other words, for many sites a large share of the login traffic isn't customers. It's bots.

Five habits that make it fail

The good news is that this attack is brittle. It only works when something you used on one site fits another. Break that link and the whole stolen list becomes useless against you.

1. A different password for every site. This is the one that matters most. A password manager makes it painless, because it generates and remembers them for you. If a breach leaks one password, only that one site is exposed.
2. Two-step login on anything important. Even a correct stolen password stops at the second step. An authenticator app is better than text messages, and passkeys, which are unique to each site and can't be reused, are better still.
3. A different email address on important sites. This is the habit almost nobody thinks of. Credential stuffing relies on the same email and password turning up in more than one place. If each site knows you by a different address, a leaked pair simply doesn't match anywhere else, even if you did reuse a password. An alias that forwards to your real inbox does this nicely, as we explain in temporary email vs. email alias.
4. Check whether you've been exposed. A free service like Have I Been Pwned (haveibeenpwned.com) shows which known breaches include your address. If one does, change that password and any others that matched it.
5. Don't use "slightly changed" passwords. Swapping a number or adding an exclamation mark between sites isn't uniqueness, and attackers are well aware of the trick.

Where a disposable address fits

For throwaway signups, a temporary email is a neat way to make stuffing pointless. If you register with a one-off address, there's no lasting email and password pair for anyone to replay elsewhere, and the address disappears long before a leak could matter. For accounts you'll keep, an alias is the better choice, since you'll need to be able to recover them. We describe the throwaway side in how to sign up for any website without revealing your real email.

The Yahoo story in the Yahoo breaches is the same chain on a far larger scale: a leak at one company, and a risk of replay everywhere else the same password was used.

Signs your account may have been targeted

• Login alerts, or password reset emails, that you didn't ask for
• Being signed out unexpectedly, or finding your password no longer works
• Orders, messages, saved addresses or settings you don't recognise
• A notice from a company that it has detected suspicious activity

If any of these show up, change the password straight away, from a device you trust. Turn on two-step login, sign out of all other sessions, and change the password on any other account where you used the same one. Then check your email account first, since it holds the keys to the rest.

If you run a website

The same attack is aimed at your login page too, so a few measures are worth having: require or strongly encourage two-step login, check new passwords against lists of known breached ones, limit login attempts in ways that aren't just based on a single address, watch for sudden spikes in failed logins, and tell users promptly if something goes wrong. Waiting for customers to change their own passwords isn't a plan.

One weak link

Your password is only as private as the least careful website that has ever stored it. You can't control how well a forum you joined in 2018 protects its database. You can control whether that leaked password opens anything else. Make every password and every important login unique, and a breach somewhere stays a breach somewhere, instead of becoming yours.

Sources

• Credential stuffing attacks: 2025 DBIR research - Verizon Business
• Credential Stuffing - PentesterLab glossary
• 23andMe Says Hackers Stole Ancestry Data of 6.9M Users - BankInfoSecurity
• 23andMe to Pay $30M for Credential Stuffing Hack Settlement - GovInfoSecurity
• 23andMe set to pay millions to settle data breach lawsuit - TechRadar