Credential stuffing
Reused credentials can turn a breach elsewhere into access here.
The idea
Credential stuffing uses previously exposed username and password combinations against other services. It differs from guessing every possible password. Reuse makes the attack more effective, while unique passwords, protected authenticators, request controls, and detection reduce exposure. Investigate account behavior and session creation rather than relying only on failed-login counts. User recovery processes also need protection.
In practice
A password leaked from an unrelated site is tried against an organization’s service. A unique password and an appropriate second factor reduce that path.
A common misunderstanding
A long password reused everywhere can still be vulnerable once one service exposes it.
Check your understanding
What personal habit directly addresses credential reuse?
Think it through: Using a unique password for each service, supported by a suitable password manager.
Reuse connects otherwise separate breaches
Credential stuffing tests exposed username-and-password pairs against another service. The attacker relies on people reusing credentials across sites. This differs from password spraying, which tries a small set of common passwords across many accounts, and from repeatedly guessing many passwords for one account. Accurate terminology helps explain why a control is relevant.
Unique passwords reduce the usefulness of a breach elsewhere, while strong additional authentication can reduce the consequence of a correct password. Service operators also need controls for automated attempts and suspicious sessions. An IP-only limit can miss distributed activity or disrupt many legitimate users behind a shared gateway.
A fictional course-portal incident
An academy notices failed logins across many accounts, with a few successful sessions followed by unusual profile changes. Analysts compare request characteristics, account outcomes, session creation, and later activity. A failed-login surge alone does not prove exposed credentials were used, so the investigation considers password spraying and ordinary client errors too.
Response should address successful access, not only the attempt volume. Review affected sessions, recovery changes, and sensitive actions according to the incident plan. Avoid sending users through an improvised recovery process that creates another phishing opportunity. Clear official communication and an established support route matter.
Compare three attack descriptions
Create fictional examples of reused credential pairs, one common password across accounts, and many guesses against one account. Match each to the appropriate term and explain which evidence would distinguish them. Use invented credentials only; do not test leaked passwords against real services.
A useful monitoring view combines attempted and successful authentication with subsequent account behavior. Low failure volume does not guarantee safety, and a high failure rate does not establish that any account was compromised. Report the observed outcomes separately and use the relevant evidence to assess actual exposure.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: An Introduction to Information SecurityOWASP: Credential Stuffing Prevention