Credential stuffing

Credential stuffing takes email and password pairs stolen in one data breach and tries them, automatically, on the login pages of other services: banks, email, shops, streaming. It does not guess anything. It bets on a human habit, using the same password in several places, and with billions of leaked pairs circulating, even a small hit rate means thousands of hijacked accounts.

It differs from a classic brute-force attack, which tries many passwords against one account. Here each account gets one or two attempts, with a password that really was that person's somewhere else. Attackers spread the attempts across thousands of IP addresses through botnets and proxies, so to the website they look like ordinary users who mistyped, which makes simple limits on failed logins far less effective.

For users, the defense is unique passwords for each site, which in practice means a password manager, plus 2FA or passkeys so a leaked password alone is not enough. Services like Have I Been Pwned let you check whether your email appeared in a known leak. Websites fight back by checking new passwords against leak lists, detecting bot traffic, adding a CAPTCHA when something looks off and alerting users about logins from unusual places.