Credential stuffing in plain English
Imagine you use the same key for your front door, office, car, and mailbox. If you lose it at the gym, whoever finds it can open not only your locker but everything else, too. They just have to try where the key fits. That’s exactly what happens with passwords in credential stuffing.
“Credentials” are the details you use to log in, such as an email address and password, and “stuffing” means cramming something in. Attackers stuff huge numbers of stolen email-and-password combinations into the login forms of online shops, email services, or cloud applications.
Unlike in a brute-force attack, the attackers don’t guess. They use real credentials that actually worked on another service. That’s why a single attempt per account is often enough – and that attracts far less attention than mass guessing.
How credential stuffing works
- Obtain data: In data breaches, login credentials fall into the hands of criminals. They are traded on the dark web, a hard-to-access, anonymous part of the internet, and collected in extensive lists known as combo lists.
- Choose targets: The attackers pick services where a hijacked account pays off – such as online shops with stored payment details, email accounts, or corporate access to cloud services.
- Try them automatically: Special programs known as bots test the combinations at high speed. To get around protective mechanisms, the attackers spread their requests across many IP addresses and mimic the behavior of real browsers.
- Cash in on the hits: Working logins are used or resold – for fraud, spam, data theft, or as a starting point for further attacks on a company.
Because the attackers use valid credentials, these login attempts initially look perfectly normal to the targeted system. That makes credential stuffing hard to detect.
A practical example
An online retailer of outdoor gear notices an unusually high number of logins one weekend. Shortly afterwards, customers get in touch: delivery addresses in their accounts have been changed and orders placed for payment by invoice. The shop itself wasn’t hacked. The criminals used credentials that had been stolen from a completely different service.
The investigation also reveals that some employees had registered with their work email address for a private online service that suffered a data breach. Anyone who used the same password there as for their company account is now putting the company at risk as well.
The retailer responds: it introduces bot detection and offers its customers multi-factor authentication (MFA) – a login with an additional code, for example from an app. It also resets the passwords of the affected employees and enforces MFA for all corporate accounts.
Why does this matter for businesses?
Credential stuffing affects companies in two ways. First, as an operator: if customer accounts in your online shop or portal are taken over, you face fraud, extra work for customer service, and loss of trust – even if your own systems weren’t hacked at all. If unauthorized parties access personal data in the process, you may also have to notify the data protection authority under Art. 33 of the EU General Data Protection Regulation (GDPR), depending on the circumstances.
Second, as an employer: if employees also use their company password for personal accounts, a data breach at any online service is enough to open the way for attackers to your company’s email, cloud storage, or VPN. Such access is often the first step toward more far-reaching attacks.
How to protect your organization
- Multi-factor authentication: Use MFA for all corporate accounts – especially email, cloud, and VPN – and offer it for customer accounts. A stolen password alone is then no longer enough.
- One password per service: Provide a password manager and make it a rule that company passwords aren’t used anywhere else.
- Block leaked passwords: When passwords are set, check them against lists of known, already leaked passwords.
- Slow down bots: Rate limiting, bot detection, and additional checks for suspicious logins, for example from new devices, make automated attacks harder.
- Watch for anomalies: Many logins from unusual networks or suddenly rising login numbers are warning signs.
- Get early warnings: Monitor whether your company’s credentials surface on the dark web, and change affected passwords before attackers use them.
- Inform users: Notify your customers of new logins and of changes to account or delivery details.
How Rootsektor can help
With our Dark Web Monitoring, you find out when credentials or other data belonging to your company surface on the dark web: our applications automatically detect any matches and notify you, after which we support you individually with countermeasures. We check whether your login pages can withstand automated login attempts in a web application penetration test. You can get a fixed-price quote for the penetration test via our Pentest Quote page. If you suspect that attackers have already gotten into company systems using hijacked credentials, a compromise assessment determines whether there are signs of a compromise. In an acute incident, you can reach us at +49 2932 465265-0 – outside our business hours of Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST), the same number is our 24/7 emergency hotline.