Cybersecurity glossary
What is credential stuffing?
Definition
Credential stuffing is an automated attack that tries usernames and passwords leaked from one service against many other services, succeeding wherever people reused passwords.
Why it matters
Attackers use large lists from past breaches and spread attempts across many IP addresses to avoid simple blocking. Users defend themselves with unique passwords and MFA; site owners add MFA, rate limiting, bot detection and checks against known breached passwords.
Common questions about credential stuffing
See also
Sources
Related Guides
GuideIncident Response
The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
Read more GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more GuideGRC
How to Report Security and Compliance Status to Leadership, Clients and Committees
How to build compliance reporting that executives, boards, risk committees and clients can act on: the metrics to include, a one-page report structure, RAG ratings and decision requests.
Read more GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more