Credential stuffing is a type of cyberattack where criminals take username and password pairs stolen in one breach and try them, automatically, against other sites. It is not guessing. It is not brute force. The passwords are real, the accounts are real, and the only question is whether the same person reused the same pair somewhere else. Usually, they did.
The raw material is effectively infinite. The RockYou2024 compilation, published in July 2024, holds nearly 10 billion unique plaintext passwords. SpyCloud's 2024 Annual Identity Exposure Report counts more than 1.38 billion username and password combinations in active criminal circulation, and its 2025 data found 87 percent of organizations had at least one employee credential exposed in a third-party breach in the prior 12 months, with a median of 42 exposed credential pairs for organizations with 25 to 500 employees. Every breach feeds the next attack, because every breach adds pairs to the list.
The attack runs in three steps, and each one is cheap. First, the pairs come from a breach, a phishing kit, or a combo list stitched together from a dozen breaches. Second, bots try them against a target site, thousands of attempts a minute, spread across residential proxies so no single IP address trips a rate limit. Third, the successes get sorted: accounts with stored payment methods, loyalty points, or admin access are worth more than the rest, and the rest get sold onward or used for spam and fraud.
The FBI's Internet Crime Complaint Center issued a public service announcement in November 2025 reporting more than 5,100 account takeover complaints and losses exceeding 262 million dollars since January 2025. The Bureau's 2025 annual report counts about 4,700 complaints and 359.7 million dollars in losses, inside a record year of 1,008,597 cybercrime complaints and 20.9 billion dollars in reported losses. Verizon's 2026 Data Breach Investigations Report puts credential abuse as the initial access vector in 13 percent of breaches, down from 22 percent, with stolen credentials used at some stage in 39 percent. The share is falling because other vectors are rising, not because stuffing stopped working.
Rate limiting fails against rotating residential proxies, because the attempts arrive from thousands of ordinary-looking addresses and no single one looks abusive. CAPTCHA mostly annoys humans; the bots that run stuffing at scale solve or bypass it as a cost of business, and every challenge you add to the login page taxes your real customers first. A web application firewall cannot see bots that mirror human behavior closely enough, because the requests look exactly like a person typing a password, and that is what they are, just faster and in bulk.
What does work is removing the reused password from the equation. Unique passwords per site break the pipeline at the first step: a pair stolen from a breach is worthless against your store if it was never used there. Multi-factor authentication breaks it at the second step, which is why attackers moved on to MFA fatigue, flooding a user with push prompts until one gets approved by accident, the attack this site covered on November 11. Breach monitoring closes the loop: if you know which of your customers appear in a new combo list, you can force a reset before the bots arrive. Stuffing is not a sophisticated attack. It is an industrial one, and it only works because reuse is the default. Change the default and the attack starves.
Keep reading: The FTC Click-to-Cancel Rule Is Dead. The Obligations Are Not, MFA Fatigue: The Push Notification Attack That Wears People Down, and The FTC Impersonation Rule: What It Changed for Fake Brands cover the nearby cases in this series.
It is an automated attack that takes username and password pairs stolen in one breach and tries them against other sites. It works because people reuse passwords, so a pair from one breach often opens accounts elsewhere.
Brute force guesses passwords blindly. Credential stuffing uses real passwords from real breaches, so the success rate is far higher and the attempts look like ordinary logins.
The FBI reported more than 5,100 account takeover complaints and over 262 million dollars in losses since January 2025. SpyCloud counts more than 1.38 billion credential pairs in active criminal circulation.
It stops the login itself, which is why attackers moved to MFA fatigue, flooding users with push prompts until one is approved by accident. Unique passwords per site plus MFA plus breach monitoring is the combination that actually breaks the pipeline.