Breaches & Passwords
Credential Stuffing: How One Leaked Password Spreads
The short version
Credential stuffing is when attackers take an email and password pair leaked from one company and feed it into software that tries the same pair on hundreds of unrelated sites. The breach is not what hurts you - reuse is. Every account sharing that password falls, and email accounts fall first because password resets cascade from there. Three things break the chain: a different password everywhere, two-factor authentication on the accounts that matter, and passkeys where they are offered.
What credential stuffing actually is
Credential stuffing is an automated login attack that uses real, already-stolen credentials rather than guessed ones. OWASP defines it as "the automated injection of stolen username and password pairs ('credentials') in to website login forms, in order to fraudulently gain access to user accounts." Nothing is cracked. The password is known to be genuine somewhere already.
That distinction matters. A brute-force attack throws thousands of guesses at one account. Password spraying throws one common password at thousands of accounts. Credential stuffing throws a list of known-good pairs at site after site, betting that people recycle. It is the cheapest of the three to run and the most likely to work.
How one leaked password becomes hundreds of break-ins
The chain is short and entirely mechanical. A company you had an account with gets breached. Your email address and password end up in a file. That file gets merged with others into a large list. Software loads the list, points it at a target site, and tries every pair through a rotating pool of IP addresses.
The attacker never targets you personally. You are one line in a file of millions. The tooling is commodity software, and the list is often free or cheap. What determines whether you get hurt is not how interesting you are - it is whether the password on that line still opens anything else.
Successful hits get sorted, tested for stored payment methods or resale value, and either used directly or sold on. The whole pipeline can run for days against a single site without a human watching it.
Reuse, not the breach, is what spreads the damage
The original breach exposes one account. Password reuse is the multiplier that turns it into ten. This has been measurable for over a decade: OWASP's own write-up notes that after the 2011 Sony incident, "two-thirds of users whose data were in both the Sony data set and the Gawker breach earlier this year used the same password for each system."
It has not improved much. Verizon's 2025 Data Breach Investigations Report research found that among users infected with information-stealing malware, the median case had "only 49% of a user's passwords across different services were distinct from each other." Bitwarden's 2025 World Password Day survey of over 2,300 employed adults across six countries found 72 percent of Gen Z respondents reuse passwords, compared with 42 percent of Boomers.
You cannot stop companies from being breached. You can decide in advance how far a single breach is allowed to travel.
Why a tiny success rate still adds up
Per attempt, credential stuffing mostly fails. Most pairs are stale, most sites do not have a matching account, and many logins are protected. But the lists are enormous, the attempts are free, and the attacker only needs the small fraction that still works. Scale converts a low hit rate into a large number of real victims.
The 2019 "Collection #1" dump is a good illustration of the raw material involved. Troy Hunt, who runs Have I Been Pwned, analysed it and published the exact counts.
| Collection #1 (January 2019) | Count |
|---|---|
| Total rows in the dump | 2,692,818,238 |
| Unique email and password combinations | 1,160,253,228 |
| Unique email addresses | 772,904,991 |
| Unique passwords | 21,222,975 |
Source: Troy Hunt, "The 773 Million Record Collection #1 Data Breach," January 2019 (troyhunt.com).
Look at the last two rows together. Over 772 million email addresses, but fewer than 22 million distinct passwords between them. That gap is password reuse, measured.
The volume is not historical. Verizon's 2025 DBIR credential stuffing research, drawn from two years of single sign-on provider logs, reported that "the median daily percentage of credential stuffing accounted for 19% of all authentication attempts," with the worst single day hitting 44 percent. Roughly one in five login attempts, on a normal day, is someone trying a stolen pair.
Why attackers go after your email account first
Your inbox is not just another account. It is the recovery mechanism for nearly every other account you own. Anyone who controls it can request a password reset at your bank, your retailer, your cloud storage, and your social profiles, click the link that arrives, and take over accounts whose passwords they never learned.
That is why a reused password on your email provider is categorically worse than the same password on a forum. One is a lost account. The other is a skeleton key. It is also why the FTC's guidance on hacked accounts tells people to check for auto-forwarding rules they did not create - a quiet forwarding rule keeps the attacker receiving your reset emails long after you change the password.
If you only ever fix one password, fix the one on your primary email, and turn on two-factor authentication there before anywhere else.
Combo lists circulate for years and never expire
The email and password lists used for stuffing are called combo lists, and they are aggregations, not single breaches. Collection #1 was assembled, in Troy Hunt's description, "from many different individual data breaches from literally thousands of different sources," and distributed through a hacking forum and a cloud storage service.
Once a pair is in circulation it stays in circulation. It gets copied, re-bundled, and resold indefinitely. Compilations keep growing: in July 2024, Cybernews reported a file it called RockYou2024 containing 9,948,575,739 unique plaintext passwords, built by scraping earlier leaks together. That one is passwords only, not pairs, so it fuels guessing attacks rather than stuffing - but it shows how this material accumulates rather than ages out.
The practical consequence: a password you leaked in 2017 and never changed is still being tried today. Time does not retire it; only changing it does.
What this looks like in real incidents
Two well-documented cases show both ends of the outcome. In April 2024, Roku disclosed that around 576,000 accounts were accessed through credential stuffing, stating the credentials came from other breaches rather than from Roku. Fewer than 400 accounts saw unauthorised purchases, and Roku enabled two-factor authentication across roughly 80 million accounts afterwards.
The second is heavier. The UK Information Commissioner's Office fined 23andMe £2.31 million on 5 June 2025 over a credential stuffing campaign that ran from April to September 2023 and reached the data of over 155,000 UK residents. The ICO's findings included no mandatory multi-factor authentication, weak password rules, and no checks against lists of known compromised passwords.
Neither company was the source of the passwords; both were the destination, which is the shape of this attack.
The defenses that break the chain
Every effective defense works by removing one link. Unique passwords stop the leaked pair from matching anywhere else. Two-factor authentication stops a correct password from being sufficient. Passkeys remove the reusable secret entirely. Exposure checking tells you which passwords are already circulating so you can retire them.
| Defense | Which link it breaks | Effort |
|---|---|---|
| A different password on every site | The stolen pair matches nothing else | Needs a password manager to be realistic |
| Two-factor authentication | A valid password alone no longer logs in | A few minutes per account |
| Passkeys (FIDO2 / WebAuthn) | There is no shared secret to leak or replay | One tap where the site supports it |
| Checking exposure | Tells you which passwords to retire now | Minutes, repeatable |
Defense categories per OWASP's Credential Stuffing Prevention Cheat Sheet and CISA's April 2025 guidance on credential reuse risk.
Passkeys deserve a note. A passkey is a cryptographic key pair bound to one website's domain, with the private half kept on your device. Nothing reusable is sent to the site, so a breach of that site yields nothing to stuff elsewhere. CISA's guidance for consumers after credential exposure is blunt: use strong, unique passwords for each account and enable phishing-resistant multi-factor authentication where it is offered.
For the password side, NIST's SP 800-63B digital identity guidelines now require verifiers to compare new passwords against a blocklist of "known commonly used, expected, or compromised passwords," including passwords from previous breach corpuses. Have I Been Pwned's Pwned Passwords service does this for individuals, and does it without seeing your password: only the first five characters of its hash leave your browser.
Why SMS two-factor is the weakest form
Any two-factor authentication beats none, but they are not equal. Codes sent by text depend on your phone number staying yours, and phone numbers can be moved to someone else's SIM through social engineering at a carrier. That is a separate attack, and it is the reason SMS sits at the bottom of the list.
NIST's SP 800-63B guidelines now classify out-of-band authentication over the public telephone network - which includes SMS one-time codes - as a restricted authenticator, and direct verifiers to consider risk indicators such as device swap, SIM change, and number porting. The rough ranking, strongest to weakest: passkeys or hardware security keys, then authenticator app codes, then SMS.
If your accounts only offer SMS, use it. Just move the important ones to an app or a passkey when the option appears, and read our companion guide on protecting yourself from SIM-swap attacks to lock down the phone number underneath.
Signs you have already been hit
Credential stuffing is loud if you know what to listen for, because both failed and successful attempts generate notifications you did not ask for. The tell is usually a small cluster of security emails arriving on a day when you were not logging in to anything.
The FTC's guidance on hacked accounts lists three tip-offs: a notification that your email address or phone number changed or your password was reset when you did not do it, a message that someone tried to log in or did log in and it was not you, and simply being unable to log in.
- Password-reset emails you did not request, especially several across different services in a short window.
- MFA prompts or codes arriving when you are not logging in - someone has a working password and is stuck at step two.
- Login alerts from unfamiliar locations, devices, or browsers.
- Mail-forwarding or filter rules in your inbox that you did not create.
- A password manager or browser warning that a saved password appeared in a breach.
If any of those show up, treat the password as burned everywhere it was used. Our guide on what to do after a data breach covers the response order in detail.
What to actually do this week
You do not need to fix everything at once. Work in priority order and the exposure drops quickly. The goal is to make sure no single leaked pair can open more than one door. Half an hour on the top few accounts removes most of the risk.
- Change your primary email password to something unique, and turn on two-factor authentication there first.
- Do the same for banking, then anything holding a saved card.
- Install a password manager and let it generate the rest over time. You do not have to migrate every account in one sitting.
- Check which of your addresses appear in known breaches, then retire every password tied to them.
- Switch on passkeys wherever a site offers them.
- Sign out of all devices on any account that showed suspicious activity.
One more thing worth knowing: NIST's guidelines explicitly say verifiers "SHALL NOT require subscribers to change passwords periodically," but should force a change when there is evidence of compromise. Scheduled rotation produces predictable variations. Uniqueness, length, and reacting to actual exposure are what matter.
Reducing what is publicly known about you helps too, since attackers pair stuffed credentials with profile data to answer security questions. Our walkthrough on shrinking your digital footprint and the opt-out guides cover that side.
Find out which of your credentials are already circulating
Run a free exposure scan to see whether your email appears in known breaches, plus which data brokers and public profiles reference you. No account, nothing stored.
Frequently asked questions
What is credential stuffing in simple terms?
It is when someone takes an email and password pair that leaked from one company's breach and uses software to try that same pair on hundreds of other sites. OWASP defines it as the automated injection of stolen username and password pairs into website login forms. No password guessing is involved - the password is already known to be real somewhere.
Am I at risk if I only reused a password on an unimportant site?
Yes, if that same password is also on an account that matters. Attackers do not care which site leaked it. What matters is whether the pair still works anywhere else. A password used on one throwaway forum and nowhere else is a much smaller problem than one used on a forum and your email.
How do attackers get my password in the first place?
Usually from a breach at a company you had an account with, from a phishing page you typed it into, or from information-stealing malware on a device. Those sources get merged into large combo lists of email and password pairs that circulate on forums and criminal marketplaces.
Why do attackers target email accounts first?
Because password resets for almost every other account run through email. Someone inside your inbox can request a reset at your bank, retailer, or cloud storage, click the link, and take over accounts whose passwords they never knew. Your email is the recovery key for everything else.
Does two-factor authentication stop credential stuffing?
It stops most of it. A correct password alone is no longer enough, so a stuffing run that finds a valid pair still fails at the second step. Roku turned on two-factor authentication for around 80 million accounts after a 2024 credential stuffing incident for exactly this reason. App codes and security keys are stronger than SMS.
Why is SMS two-factor authentication the weakest form?
Because the code goes to a phone number, and phone numbers can be moved. NIST's SP 800-63B digital identity guidelines classify out-of-band authentication over the public telephone network as a restricted authenticator and tell verifiers to watch for SIM changes and number porting. SMS two-factor is still far better than none - just upgrade it where you can.
How can I tell if my accounts have been hit?
The FTC lists three tip-offs: a notification that your email address or phone number changed or your password was reset when you did not do it, a message that someone tried to log in or did log in and it was not you, and being unable to log in at all. Unrequested MFA prompts are another sign.
Do I need to change my password every 90 days?
No. NIST's SP 800-63B guidelines say verifiers should not require periodic password changes, but should force a change when there is evidence the password has been compromised. Routine rotation tends to produce predictable variations. Uniqueness and length matter far more than a calendar.
Sources: OWASP Foundation (credential stuffing definition and the Sony/Gawker password-reuse finding) and the OWASP Credential Stuffing Prevention Cheat Sheet; Troy Hunt / Have I Been Pwned, "The 773 Million Record Collection #1 Data Breach," January 2019, and the Pwned Passwords service; Verizon 2025 Data Breach Investigations Report credential stuffing research; Bitwarden World Password Day global survey, 2025; NIST SP 800-63B digital identity guidelines (password blocklists, periodic-change guidance, and restricted PSTN authenticators); CISA guidance on credential reuse risk, April 2025; FTC Consumer Advice, "Email or social media hacked? Here's what to do," 29 October 2024; Roku's April 2024 disclosure as reported by TechCrunch; UK Information Commissioner's Office penalty notice against 23andMe, 5 June 2025; Cybernews reporting on the RockYou2024 password compilation, July 2024.