What Is Credential Stuffing? How It Works and How to Prevent It

Credential stuffing is the reason a breach at a company you've never heard of becomes a login into your bank account three years later. It's one of the most common, most successful, and most misunderstood cyberattacks in circulation today, and it doesn't require attackers to hack anything. They just log in.

If you've read a headline about a "data breach" at a major consumer brand in the last few years, chances are you were reading about a credential stuffing attack. Chick-fil-A, Roku, Okta, General Motors, Norton, Zoom, Dunkin' Donuts, and Spotify have all been hit by one. And the pattern is almost always the same.

Here's what credential stuffing actually is, why it works so well, and what your organization can do about it.

What is credential stuffing?

Credential stuffing is a cyberattack in which threat actors use stolen username and password pairs, typically obtained from unrelated data breaches, to attempt automated logins across many different online services at once. The attacker isn't guessing passwords. They already have them. They're just testing whether those passwords still work somewhere else.

The technique relies on a single, widespread human behavior: password reuse. When a person uses the same password across multiple accounts, a leak at any one of those services becomes a working key to all of them.

Credential stuffing is not the same as a brute force attack. In brute force, attackers try random or common password combinations against a single account. In credential stuffing, attackers already possess valid credentials from another breach and are checking where else those credentials will unlock a door.

How does credential stuffing work?

A credential stuffing attack typically unfolds in five steps.

1. Attackers acquire stolen credentials. These come from prior data breaches, dark web marketplaces, infostealer malware logs, or leaked credential dumps. In mid-2025, researchers uncovered a single database containing 16 billion stolen login credentials, the largest credential leak ever recorded.

2. Credentials are compiled into "combo lists." Attackers organize username and password pairs into files that automated tools can process at scale.

3. Automated bots attempt logins. Attackers point their bots at the login pages of target services and start firing credentials at machine speed. Akamai tracked roughly 26 billion credential stuffing attempts per month across the sites it monitors in 2024.

4. Successful logins are captured. Even a success rate below one percent is worthwhile. Testing a million credentials against a single service can yield thousands of working logins.

5. Compromised accounts are monetized. Attackers drain loyalty balances, make fraudulent purchases, harvest personal data for identity theft, or resell verified working accounts on dark web markets. The valuable accounts, banking, email, cloud storage, get used directly. Everything else gets sold.

None of this requires sophisticated hacking. It requires stolen credentials, a bot, and a target service that permits automated logins without strong controls.

Why credential stuffing keeps working

Credential stuffing succeeds because the underlying conditions that enable it have not changed in more than a decade. Three factors keep it viable.

Password reuse is nearly universal. Studies consistently show that the majority of people reuse passwords across at least some of their accounts. Attackers count on this.

The supply of stolen credentials is enormous and growing. Check Point reported a 160 percent year-over-year increase in compromised credentials entering 2025. Infostealer logs and combo lists circulate freely on Telegram channels and dark web forums. The pool of weaponizable credentials is expanding faster than most organizations can respond.

Many services do not enforce strong authentication. Multi-factor authentication (MFA) is widely available but often optional. When MFA is not required, a valid password is all an attacker needs.

The attack is cheap. The credentials are already stolen. The tooling is off the shelf. The target list is essentially every service that permits password-based login. That is why credential stuffing is the preferred technique for high-volume account takeover.

Real-world credential stuffing examples

Credential stuffing has driven some of the most widely reported "breaches" of the last several years. In almost every case, the company itself was not compromised. Its customers' reused passwords were.

Chick-fil-A (June 2026). Attackers ran a credential stuffing attack against the Chick-fil-A One loyalty app between June 17 and 19, 2026, using credentials obtained from a third-party source. Exposed data included names, email addresses, loyalty balances, QR codes, partial payment card numbers, and for some accounts, birthdates, phone numbers, and home addresses. This was Chick-fil-A's second credential stuffing incident. A nearly identical attack in December 2022 through February 2023 compromised more than 71,000 accounts.

Roku (2024). Two credential stuffing attacks hit Roku in March and April 2024, compromising roughly 591,000 customer accounts. Roughly 400 of those accounts were used to make unauthorized purchases. After the second attack, Roku enabled two-factor authentication across all accounts by default.

Okta (April 2024). Okta detected credential stuffing attacks targeting customers who had the cross-origin authentication feature enabled. The incident was notable because Okta is a leading identity provider, underscoring that even security-focused platforms are targets for this technique.

General Motors (May 2024). Unauthorized parties accessed 65 GM customer accounts and used them to purchase GM products and accessories. GM attributed the compromise to credentials leaked in unrelated breaches.

Norton LifeLock (January 2023). Attackers ran approximately 925,000 credential pairs against Norton's password manager service and successfully compromised about 6,450 customer accounts, a roughly 0.7 percent success rate. The attack was particularly noteworthy because Norton is a cybersecurity company, and the compromised accounts contained password vaults.

Zoom (April 2020). Amid pandemic-era adoption, attackers used credentials from prior breaches to compile lists of working Zoom logins. Approximately 500,000 valid Zoom credentials were later found circulating on dark web forums.

Dunkin' Donuts (2018 and 2019). Dunkin' was hit by two credential stuffing attacks within three months in 2019, following a similar attack the year before, in each case targeting the DD Perks rewards program.

The pattern is consistent. The targets vary. The mechanism does not.

How to protect your organization from credential stuffing

For businesses, defending against credential stuffing means making stolen credentials useless even when attackers have them. That requires a combination of identity controls, monitoring, and user practices.

Enforce phishing-resistant MFA

Multi-factor authentication is the single most effective defense against credential stuffing. When a valid password alone cannot grant access, stolen credentials lose most of their value. Phishing-resistant MFA methods like passkeys, hardware security keys, or authenticator apps are preferable to SMS-based codes, which can be intercepted.

Availability is not enough. MFA must be required, not offered. Chick-fil-A offered MFA on its loyalty accounts in both 2023 and 2026. The attacks still succeeded because most customers had not turned it on.

Use conditional access and login monitoring

Modern identity platforms can detect and respond to suspicious login patterns automatically: logins from unusual locations, impossible travel between sessions, high-velocity login attempts, or logins from known malicious IP addresses. Conditional access policies can trigger step-up authentication, block sessions, or alert administrators when patterns indicate a credential stuffing attempt.

Deploy bot detection and rate limiting

Because credential stuffing is automated, defenses that specifically target bot behavior are highly effective. Web application firewalls, rate limiting on login endpoints, and CAPTCHA challenges triggered by suspicious patterns can dramatically reduce the volume of automated attempts a service has to process.

Monitor for compromised credentials

Services that check employee and customer credentials against known breach corpuses (such as the Have I Been Pwned database) can flag reused or leaked passwords before attackers use them. If a credential appears in a public breach, force a reset.

Require strong, unique passwords and provide a password manager

Password policies should require length and uniqueness. More importantly, organizations should provide employees with an enterprise password manager. Requiring unique passwords without giving people a tool to manage them is a policy that fails in practice.

Train users on the reuse problem

Most people underestimate how catastrophic password reuse is. Security awareness training should specifically address why reusing a password, even a strong one, creates cross-service risk. The training should also explain what a password manager does and how to use one.

How individuals can protect themselves

For the individual, the guidance is short and it works.

• Use a password manager. A password manager generates and stores a unique password for every account so you never have to reuse one. This is the single most impactful thing you can do.
• Turn on MFA everywhere it's available. Especially for email, financial accounts, cloud storage, and any account that stores payment information.
• Check whether your credentials have been leaked. Tools like Have I Been Pwned let you check whether your email has appeared in known breaches. If it has, change the associated passwords immediately.
• Don't store payment methods in accounts that don't need them. The less that's stored, the less an attacker can do with a successful login.

Frequently asked questions

Is credential stuffing the same as a data breach?

Not exactly. Credential stuffing is an attack that exploits credentials leaked from previous breaches. The company being targeted has not necessarily had its own systems compromised. When a company discloses "unauthorized access" resulting from credential stuffing, the breach that actually leaked the credentials likely happened somewhere else, sometimes years earlier.

Does MFA stop credential stuffing?

Yes, in almost all cases. When multi-factor authentication is required on an account, a valid password is not sufficient to log in. The attacker also needs a second factor, which they typically do not have. This is why enforcing MFA is the single most effective defense.

How do attackers get the credentials in the first place?

From prior data breaches, infostealer malware, phishing campaigns, and dark web marketplaces that aggregate and resell leaked credential dumps. The supply is vast and continuously growing.

Why do companies keep getting hit if this is a known problem?

Because credential stuffing exploits the customer, not the company. As long as customers reuse passwords and companies make MFA optional rather than mandatory, the technique will keep working. The economics favor the attacker: credentials are cheap, tooling is free, and even a low success rate produces valuable results.

Is credential stuffing illegal?

Yes. Credential stuffing is a form of unauthorized computer access and violates laws like the Computer Fraud and Abuse Act in the United States, along with equivalent statutes in most other jurisdictions. Prosecution is difficult because attackers typically operate from jurisdictions outside the reach of the affected parties.

The takeaway

Credential stuffing is not a sophisticated attack. It's a scalable one. It works because the ingredients are cheap and abundant: stolen credentials, automated bots, and services that permit password-only logins. Every high-profile "breach" driven by credential stuffing is really a story about accumulated password reuse finally catching up with someone.

The defenses are well understood. Mandatory MFA, unique passwords, credential monitoring, and bot detection will neutralize the vast majority of these attacks. The challenge isn't knowing what to do. It's making the effort to actually do it, both as a business protecting your customers and as an individual protecting yourself.

At edgefi, we help organizations design and operate the identity and access controls that make credential stuffing attacks fail. If you're not sure where your organization stands, or you want to talk through your current MFA and identity posture, we're happy to have that conversation.