Credential stuffing is the automated testing of stolen username and password pairs against a login form, using lists harvested from earlier breaches. The attacker buys or downloads combo lists of email and password pairs, loads them into automation tools like Sentry MBA, SNIPR, or OpenBullet, rotates through residential proxies to avoid rate limits, and fires them at the target site's login page. Pairs that succeed are sorted by value: accounts with stored cards, balances, loyalty points, or personal data, and sold on shops and Telegram channels, or used directly. Akamai counted 26 billion credential-stuffing attempts a month in 2024. The success rate per attempt is low, often 0.1 to 2 percent, but the volume makes it pay: 0.1 percent of a 500-million-record combo list yields 500,000 validated accounts. The biggest single fallout is the 23andMe breach, which exposed 6.9 million people's data after about 14,000 accounts were stuffed, and cost the company a $30 million settlement.
Why the login form is the target
The login form is the target because it is the only place where a stolen credential becomes an account, and because password reuse makes the lists work. SpyCloud's 2025 Identity Exposure Report puts password reuse at 65 percent of users, which means a pair stolen from one breach has a two-in-three chance of working somewhere else. The attacker does not need to breach your site. They need to breach any site, and your users' habit of reusing passwords does the rest. A single leaked database from a mid-tier retail breach in early 2026 contained 4.3 billion username-password pairs, and within 72 hours automated bots had tested a significant portion of them against banking portals, SaaS platforms, and healthcare patient portals across North America and Europe.
The attack is cheap to run and expensive to absorb. Combo lists sell for a few dollars, the tools are free, and proxies cost cents, so even a teenager can compromise 60,000 accounts, as Joseph Garrison did. The defender absorbs breach costs averaging $4.9 million per incident, per the 2026 Verizon Data Breach Investigations Report, which found stolen credentials implicated in over 61 percent of confirmed breaches. The asymmetry is the point: the attacker spends fractions of a cent per tested pair, and the defender pays millions when enough of them work.
Related reading on this site: Home and Fake Account Signups: How Stores Spot and Stop Them cover the neighbouring problems in more depth.
What the attack looks like in your logs
Credential stuffing announces itself in patterns a single request hides. Login attempts in the thousands from rotating addresses, with a high failure rate and a low but steady success rate, are the signature. The attempts often come in low-and-slow form now, precisely to evade threshold-based rate limits: Akamai's 2026 report describes a precision attempt of just 164 requests engineered to bypass rate limits and establish synthetic identities, running alongside a reconnaissance barrage of 42,000 requests over seven days against the same institution. The two attacks work together: the barrage validates the credential database for resale, and the slow trickle establishes the accounts.
Globally, more than one in three login attempts observed by Akamai were flagged as high or critical risk, 26.6 percent globally and 36.4 percent across Asia Pacific, and account verification requests accounted for 40 percent of high or critical risk login activity, which indicates attempts to validate accounts before launching credential stuffing attacks. The first signal is usually not in the login logs at all. It is in the account verification requests, the password resets, and the email change attempts that follow a successful stuffing, because the average time between a successful credential validation and the first fraudulent action, an account email change, a payment method modification, or data exfiltration, is under four minutes for financially motivated attackers using automated post-exploitation scripts.
The controls that actually stop it
Rate limiting alone does not stop credential stuffing, because the attack is designed around it: rotating proxies, low-and-slow pacing, and distributed sources. The controls that work are layered. Bot management at the edge, Cloudflare Bot Management, Akamai Bot Manager, DataDome, or Imperva, uses behavioural biometrics, mouse movement entropy, keystroke cadence, scroll patterns, JavaScript challenge execution, TLS fingerprinting, and IP reputation scoring to classify traffic before it reaches the application. In a documented case study published by Akamai in the third quarter of 2025, a major North American bank reduced account takeover-related authentication fraud by 94 percent after deploying multi-signal bot management in blocking mode, down from roughly 12,000 account compromise events per month.
The second layer is the account itself: multi-factor authentication, breached-password screening at login and at password change, and step-up authentication when a login comes from a new device or location. The third layer is the response: when a stuffing attack is detected, force password resets on the affected accounts, invalidate sessions, and notify the users, because the accounts that were validated are already being sold. Configure bot management in adaptive learning mode for 30 to 45 days before switching to enforcement, and establish bypass rules for legitimate automation, monitoring agents and CI/CD pipelines, so the controls do not block the traffic the site needs.
Frequently asked questions
What is credential stuffing?
Automated login attempts using breached username and password pairs. Attackers load combo lists from earlier breaches into tools that rotate through residential proxies and fire them at a login page, exploiting the fact that 65 percent of users reuse passwords across services.
How many credential stuffing attempts happen each month?
Akamai counted 26 billion attempts a month in 2024. The success rate per attempt is low, often 0.1 to 2 percent, but at that volume the fraction pays: 0.1 percent of a 500-million-record combo list yields 500,000 validated accounts.
What does credential stuffing look like in the logs?
Login attempts in the thousands from rotating addresses, with a high failure rate and a low but steady success rate. Modern attacks also run low-and-slow, a few hundred requests engineered to bypass threshold-based rate limits, alongside larger reconnaissance barrages.
What stops credential stuffing?
Layered controls: bot management at the edge using behavioural biometrics, TLS fingerprinting, and IP reputation; multi-factor authentication and breached-password screening on the account; and a fast response that forces password resets and invalidates sessions when an attack is detected.