What is credential stuffing? How it works and how to stop it

Credential stuffing is the automated replay of usernames and passwords leaked from one website against the login of another. It works because people reuse passwords, so a breach at a forum in 2019 can open a shopping account in 2026. The attacker does not need to break anything on your side, because every login request they send is well formed and some of them carry the right password.

The OWASP Automated Threat Handbook calls it OAT-008 Credential Stuffing and defines it as "mass log in attempts used to verify the validity of stolen username/password pairs". The same entry lists the other names it goes by, including password stuffing, credential replay, account checking and login stuffing. If you came here searching for "password stuffing", it is the same attack.

How a credential stuffing attack runs

A combo list. The attacker starts with a list of email and password pairs, usually called a combo list, built from earlier data breaches and passed around or sold on criminal forums. The pairs did not come from your site, which is why 23andMe and Roku both said in their disclosures that the passwords had come from elsewhere.

A checker tool. Off-the-shelf tools take the list and a configuration file describing your login request, then fire the pairs at it and sort the results into hits and misses. BleepingComputer reported that attackers going after Roku accounts used OpenBullet 2 or SilverBullet, two widely available tools of this kind.

Proxies to spread the load. A single server sending a million logins is easy to block by IP address, so attackers route the traffic through proxy networks. Residential proxies send each request out through a real home broadband connection, so the IP address belongs to an ordinary ISP and has no bad history. With a large enough pool each IP makes only a few attempts, which stays under any per-IP limit you have set.

Low hit rate, huge volume. Most pairs fail, because most people changed the password or never had an account with you. The attack still pays because it is cheap to run. As an illustration, if one pair in a thousand works, a list of ten million pairs yields ten thousand working accounts. Those accounts are then used directly or sold on, and the Roku accounts were reported to be selling for as little as 50 cents each.

Cashing out. What happens next depends on what the account holds: saved cards, stored balance, loyalty points, personal data or access to other people's data. That second stage is account takeover.

Credential stuffing, password spraying and brute force compared

These three get confused because all of them are automated guessing at a login form, but each relies on a different weakness and so each needs a different defence.

MITRE ATT&CK describes password spraying as using "a single or small list of commonly used passwords against many different accounts". Credential stuffing differs in that the attacker already knows which password to try for which account. The glossary entry on credential stuffing has the short version.

Credential stuffing incidents with public records

23andMe, 2023. In an amended Form 8-K filed with the SEC on 1 December 2023, 23andMe said the attacker accessed about 0.1% of user accounts where the password matched one used on other, previously compromised websites. Its own update put that at roughly 14,000 accounts out of 14 million customers. Through those accounts the attacker reached about 5.5 million DNA Relatives profiles and about 1.4 million Family Tree profiles, because the features let each account see data shared by relatives. The company made all users reset their passwords on 10 October 2023 and required two-step verification from 6 November 2023.

Roku, 2024. Roku disclosed a first incident affecting 15,363 accounts in March 2024 and then, on 12 April 2024, a second affecting about 576,000 more, according to BleepingComputer. In fewer than 400 of those accounts the attackers used a stored payment method to buy subscriptions and hardware. Roku then turned on two-factor authentication by default for every account.

The North Face, 2025. Parent company VF Corp told customers that "an attacker had launched a small scale credential stuffing attack against our website on April 23, 2025". BleepingComputer counted it as the fourth credential stuffing incident on the site since 2020, after attacks in November 2020, September 2022 (over 200,000 customers) and March 2025 (about 15,700 accounts across The North Face and Timberland). Exposed data included names, addresses, purchase history, dates of birth and phone numbers. Card details were held by a payment provider and were not exposed.

Dunkin', 2015 attacks, 2020 settlement. The New York Attorney General sued Dunkin' in 2019 over credential stuffing against customer accounts that held stored-value cards, starting in early 2015. A third-party app developer had given Dunkin' a list of nearly 20,000 accounts compromised in a sample five-day period. Dunkin' settled in September 2020 for $650,000 in penalties and costs and agreed to notify and refund customers, reset passwords and keep reasonable safeguards against brute force and credential stuffing. The case is worth knowing because the passwords came from other companies' breaches and the regulator still held Dunkin' responsible for protecting the accounts.

Credential stuffing defences, in order of impact

1. MFA or passkeys. A second factor means a correct stolen password is no longer enough to get in, and a passkey removes the reusable password altogether. Both 23andMe and Roku added this after their incidents. MFA leaves the attack traffic itself untouched, and SMS-based codes add their own cost, which the SMS pumping article covers.

2. Check passwords against breach lists. NIST's digital identity guidance, SP 800-63B, says that verifiers "SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords" whenever a password is set or changed. Have I Been Pwned offers Pwned Passwords for this. A password that is not on any breach list cannot be in a combo list either.

3. Rate limits that survive IP rotation. Limiting attempts per IP address does little against an attacker with a residential proxy pool. Count attempts per target account, per device or session, and per network, and count failed logins across the whole site, so that a rise in failures shows up even when no single source crosses a threshold.

4. Bot detection at the login and password-reset endpoints. Stopping the automation removes the attack at its source, before any password is checked. Useful signals here are the ones a checker tool cannot easily change: whether the connection comes through a proxy, IP reputation, the TLS fingerprint of the client, and how the visitor interacts with the page. Signals based only on browser properties are weaker, because attackers use anti-detect browsers that report whatever the operator chooses.

5. Monitor the login success ratio. A normal login page has a steady ratio of successful to failed logins. A stuffing run pushes failures up sharply, often together with a spike in logins for accounts that have not been used in a long time. Alert on the ratio, not just the volume, because a slow attack can keep volume flat.

How Prosopo stops credential stuffing

Prosopo checks each request to your login, password-reset and account-recovery endpoints and blocks the automation before a password is checked. Residential proxy detection compares the TCP connection with the device the browser claims to be, checks live IP intelligence, and matches exit IPs against proxy networks Prosopo rents and probes itself. Prosopo Protect runs the same checks on every request at your edge, on Cloudflare Workers or AWS Lambda@Edge, so attacks against an auth API that never loads a form are covered too. Every block names the reason it fired.

The credential stuffing use case page has production figures from a financial provider and the products to use.