Credential Stuffing: Definition, Techniques & Defense

Topics

Cybersecurity, Secure Access, Security

TL;DR

Credential stuffing is a cyberattack that exploits reused passwords by automating login attempts with stolen credentials. With over 15 billion breached username/password pairs circulating online, no organization is immune, as high-profile breaches at eBay and JPMorgan Chase demonstrate. Defending against it requires a layered approach: unique passwords, frequent credential rotation, two-factor authentication, and enterprise-level monitoring and custom bot-deterrent solutions.

What is credential stuffing?

Credential stuffing is a popular type of cyberattack. It is the automated injection of breached username and password combinations in order to fraudulently gain access to user accounts.

Hackers want into your servers. You want to keep them out. You use a sophisticated password process, including a requirement for frequent credential changes. It seems like a foolproof system, but it comes with one major flaw.

If people reuse passwords (and many of us do), you could be open to a devastating attack.

More than 15 billion stolen credentials are available on black markets today. Often, hackers don't even need to pay for the weapons they can use against you. With this database, they could have the names/passwords of one of your employees. With a bit of hacking, they could spot your vulnerability and take over.

Credential stuffing attacks are devastating. But they can be prevented.

Credential Stuffing Attacks

How does a credential stuffing attack work?

Credentia stuffing involves stolen usernames or passwords. A hacker plugs the data into a bot and launches an attack to determine if the same combination opens up any other servers.

Every attack is different, but most follow this step-by-step plan:

Discovery: A hacker finds a cache of username/password combinations exposed via some other attack.
Modeling: The hacker runs a few tests to see if these combinations work on other websites.
Large-scale work: The hacker uses tools to launch an attack against a server. All the stolen pieces come in as a flood of login attempts. If even one works, the hacker has access.
Theft: The hacker looks for anything of value within the account, such as credit card numbers, Social Security numbers, and other login data.
Ransom: The hacker points out the theft to the company and asks for a financial reason to give access back.

Credential stuffing is a form of brute-force attack. Hackers may only have one or two name/password combinations that work. But all of them are pointed at the server.

Can you prevent credential stuffing?

No company wants data exposed. But preventing credential stuffing attacks means asking for help both from programmers and members. You must work in partnership to ensure that hackers don't get a toehold into the company's server.

Employees, users, and others with server passwords must:

Craft unique passwords. Reusing information, even once, means exposing your servers to risk. It's difficult to remember dozens of unique credentials, but a password manager can help you both create and store the data to make use easier.
Change passwords often. Cycle through passwords frequently, and change them in meaningful ways. Don't shift one letter or number, for example. Amend the entirety of the login.
Turn on two-factor authentication. Get a notification on your phone or another connected device when you attempt to log in. This one small step can keep hackers away, and you might discover that plenty of people are trying to use your details.

At the enterprise level, companies can:

Educate. Tell your users why good password practices are so important and develop guidelines that explain what they can do to help protect data.
Watch attempts. Keep a close eye on login attempts. A spike could indicate that your company is under attack.
Create custom solutions. You could use Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) or another login hurdle to defeat bots. But some experts suggest that the best prevention tools are made from scratch.
A hacker may develop tools to get around common firewalls. If yours is new and unique, a hacker may simply choose to move on instead of spending time to defeat it.

These steps may not eliminate your risk of a data breach. But you could make your server a less attractive target to a hacker. That could save your company a great deal of heartache.

How serious is an attack?

The Securities and Exchange Commission says credential stuffing attacks are on the rise. Large lists, including the Pemiblanc list that contains more than 111 million records, are to blame. With so much username/password data available, hackers can't seem to resist.

Real-world examples of credential stuffing breaches

One of the biggest credential stuffing examples comes from May of 2014. Hackers got access to the credentials of three eBay employees, and they used that to gain access to the network and the database. Hackers held onto that access for a whopping 229 days.

In 2014, JPMorgan Chase endured a similar attack, but officials had no idea it was happening. A contractor discovered the breach, along with a cache of a billion stolen usernames and passwords.

Company	Year	Attack method	Impact
eBay	2014	Credentials of 3 employees compromised	229 days of unauthorized network and database access
JPMorgan Chase	2014	Contractor-discovered breach	~1 billion stolen usernames and passwords

It can take years to recover from a breach like this, and some of your customers may never fully forgive your violation of trust. When it comes to hacking, prevention is the best policy.

Get help from Okta

Learn how Okta can protect your organization's credentials and prevent attacks like credential stuffing. We'd love to walk through your processes and help you come up with a security system that works.

Frequently asked questions

What is credential stuffing?

Credential stuffing is a type of cyberattack where hackers use automated bots to inject stolen username and password combinations into login pages, attempting to gain unauthorized access to user accounts across multiple services.

How is credential stuffing different from a brute-force attack?

Credential stuffing is a specific form of brute-force attack. Rather than guessing random passwords, attackers use real, previously breached credentials — often sourced from dark web marketplaces — to target accounts where users have reused the same login details.

Why does password reuse make credential stuffing so dangerous?

When users reuse the same password across multiple accounts, a single data breach can expose them everywhere. With over 15 billion stolen credentials available on black markets, attackers have a vast arsenal to test against any server.

What can individual users do to protect themselves?

Users should create unique passwords for every account, change them frequently in meaningful ways (not just minor character swaps), and enable two-factor authentication. A password manager can help generate and store complex, unique credentials.

What steps can enterprises take to defend against credential stuffing?

Organizations should educate users on strong password practices, monitor login attempts for unusual spikes, and implement custom bot-deterrent solutions such as CAPTCHA or proprietary login hurdles that are harder for attackers to circumvent than off-the-shelf firewalls.

How severe can the consequences of a credential stuffing attack be?

The consequences can be severe and long-lasting. In one notable case, hackers maintained access to a major financial institution's network for 229 days before being discovered. Recovery can take years, and the resulting loss of customer trust may be permanent.