What is it
Credential stuffing is the automated testing of username and password pairs, taken from previous breaches elsewhere, against your login.
How it works
Billions of credentials from historical breaches are freely available. Attackers replay them at scale against other services, relying on password reuse. Because every individual attempt uses a genuine, correct-looking credential, it does not resemble brute force and often evades naive detection.
Why it matters
It requires no skill and no vulnerability in your application. If your users reuse passwords, and they do, you are exposed regardless of how well your code is written.
What can happen
Account takeover, fraud, exposure of personal data, and reputational damage that lands on you rather than on the service originally breached.
How to detect it
Elevated login volume with an unusual success ratio, many accounts attempted from few addresses, logins from new geographies, and traffic patterns that are too regular to be human.
How to defend
MFA is the decisive control. Check credentials against known-breached password lists at registration and reset. Rate limit by account as well as by address. Use progressive delays and risk-based challenges rather than hard lockouts, which create denial of service.