Credential stuffing is an attack in which bots take username and password pairs leaked from another website and try them, in bulk, on your login page. The attacker does not guess passwords; they replay real ones that employees have reused elsewhere. The core defences are therefore ending password reuse, verifying that a human is signing in, and being able to end sessions from one place.
Key takeaways
- Credential stuffing is the automated testing of leaked passwords across many accounts; it only works because the same password is used in more than one place.
- According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks.
- In Verizon's 2026 DBIR, use of stolen credentials appears as an action in 36% of breaches.
- The strongest controls are unique passwords, multi-factor authentication, bot filtering at login, a single identity and central session sign-out.
- The visible symptom is usually lots of failed logins; the real danger is the handful that succeed.
How does credential stuffing work?
The attack runs in four stages. First, email and password lists leak from a service such as an online shop, a forum or a gaming platform. These lists are sold, merged and circulated as "combo lists". The attacker then loads a list into a bot and works through thousands of pairs against your business email, file-sharing or admin portal login.
If one of your staff used their work address on a personal site and picked the same password, the bot eventually lands on the right pair. Once in, the attacker looks like a legitimate user: encrypted connection, correct password, ordinary session. OWASP's description of credential stuffing classes it as an automated account takeover technique and points to password reuse as the root cause.
Credential stuffing vs brute force vs password spraying
These three attacks are often confused, and the defences carry different weight for each.
| Attack | What is tried? | What it exploits | Most effective control |
|---|---|---|---|
| Credential stuffing | Real username and password pairs leaked from other sites | Password reuse | Unique passwords, MFA, bot filtering at login |
| Brute force | Many possible passwords against one account | Short, simple passwords | Long passwords, attempt limits, lockout |
| Password spraying | A few common passwords across many accounts | Predictable passwords | Banned-password list, MFA |
What sets credential stuffing apart is the very low number of attempts per account. Because each account is tried only once or twice, the classic "lock after five failed attempts" rule often never fires.
What does credential stuffing cost a business?
Identity attacks are now the main way in. The Microsoft Digital Defense Report 2025 says more than 97% of identity attacks are password attacks, and that phishing-resistant MFA can stop over 99% of them.
The Verizon 2026 Data Breach Investigations Report records the use of stolen credentials as an action in 36% of breaches. Meanwhile, Sophos' The State of Identity Security 2026 research found that only 24% of surveyed organisations continually monitor for unusual login attempts.
A hijacked business mailbox is used to send fake invoices, read customer correspondence and phish colleagues from a trusted address. Unauthorised access to a mailbox holding personal data can count as a data breach under Article 12 of Türkiye's data protection law (KVKK); the notification process is covered in our guide to the 72-hour KVKK breach notification.
How can you spot a credential stuffing attack?
The evidence usually sits in your sign-in logs. Review these signals weekly:
- Many failed sign-ins across lots of different usernames in a short window.
- Login attempts against usernames that do not exist or were closed years ago.
- Requests from unusual countries or from a large spread of IP addresses.
- Staff reporting "I didn't change my password but I was signed out" or "I got an alert about a device I don't recognise".
- Forwarding rules in a mailbox that nobody set up.
The last two signs may mean an account is already compromised. If so, the first steps are set out in compromised email account: the first 24 hours.
How do you prevent credential stuffing? A 7-step plan
No single control is enough; the steps below reinforce one another.
- End password reuse. Every employee needs a long, unique password for work accounts, and a password manager makes that practical. Rules and a sample policy are in our business password security guide.
- Turn on multi-factor authentication. When a correct password is not enough on its own, credential stuffing largely stops working. Choosing a method is covered in multi-factor authentication for business, with a short definition in the glossary entry for MFA.
- Filter bots at the login page. Human verification, IP and rate limiting, and device signals help tell a person from a script.
- Reduce the number of passwords. A separate password for every app multiplies the chance of reuse. Signing in with one identity (single sign-on) shrinks both the password count and the attack surface.
- Make sessions visible and revocable. Seeing which devices hold open sessions, and closing them all in one step when in doubt, shortens the useful life of a stolen password.
- Close leavers' access the same day. Forgotten accounts are easy targets for combo-list passwords; the checklist is in offboarding all employee accounts.
- Brief your staff. Explain that a leak on a personal account also puts the work account at risk, and that many passwords are harvested through phishing emails.
To set priorities, start by listing how many separate login pages and passwords your organisation has. For the wider picture, the SME cyber security checklist is a good starting point.
How does Smart360 reduce credential stuffing risk?
Smart360 is a family of business applications that brings SmartMail, SmartFiles, SmartOperator and SmartPass together in one ecosystem managed from a single panel. For credential stuffing, what matters is that it structurally narrows the three things the attack relies on: the login page, the number of passwords and open sessions.
- Bot filtering at sign-in: Smart360 Security protects the organisation panel login and the SmartMail and SmartFiles login screens against automated bot traffic. Every sign-in goes through human verification, and the login request does not reach the server until verification is complete, so password-guessing attacks are stopped at this layer.
- One identity (SmartID): Staff sign in to every product with one password and move between products without signing in again; there is no separate password per product. Mailbox passwords are generated by the system, stored encrypted and never handed out to staff, so access to a shared mailbox is a permission rather than a password.
- Central session management: Open sessions are listed with device details, and a single device or all other devices can be signed out remotely. When a password changes, sessions on every device are closed.
- Revoking access in one place: When someone leaves, an administrator closes their access in one place, however many products they used.
Scenario: At an accountancy practice, a member of staff once used their work address and the same password on an online shop that was breached months ago. A bot tries that pair on the practice's email login; because Smart360 Security's human verification is not completed, the request never reaches the server. As a precaution, the administrator still asks the employee to change their SmartID password, and the moment it changes, the sessions on their phone and home laptop are closed too. Nobody was ever given the password for the accounts@ mailbox, so there is no shared password to rotate.
Product details are on the Smart360 product page, and the inbound email checks are described on the SmartMail page.
How can Digital Bridge help?
Digital Bridge tackles credential stuffing through process as well as software. Through our cyber security consultancy, we use vulnerability scanning and penetration testing to find internet-facing login pages and weak authentication points, and report the findings in order of risk with a fix for each; staff awareness training then addresses password reuse and phishing.
When you move to Smart360, the domain and DNS records, mailboxes, permissions and storage areas are configured with guidance from the Smart360 team. To plan coexistence with existing systems and a migration timetable, request a call through our contact page.
What should you do next?
Start with three tasks this week: check your sign-in logs for clusters of failed attempts, enable MFA on work accounts and count how many separate passwords your organisation uses. All related articles are collected in our Security and KVKK guides.
If you want to reduce passwords to a single identity and protect sign-ins with bot verification, you can buy Smart360 through the Smart360 purchase page; to look at the product first, visit our Smart360 page.