Your email address isn't private, and neither is the password you used for everything back in 2016. Somewhere, both of them sit on a list.
Credential stuffing is the practice of taking username-and-password pairs stolen from one service and testing them, by the thousand, against other services. It isn't clever. It doesn't need to be. If you use the same password in more than one place, an attacker who breaks into the weakest site you ever registered with gets a key that may also open your email, your bank, and your social accounts.
How Credential Stuffing Actually Works
Start with a breach at a forum or a small online shop you barely remember joining. The attacker walks away with a database of email addresses and passwords. Those pairs get added to a collection that circulates among criminals, gets merged with others, and is resold. Some lists contain millions of entries; most are old, messy, and entirely free to anyone who knows where to look.
Then the testing begins. Purpose-built tools take those lists and fire login attempts at a target site, often routing traffic through thousands of residential proxies so the requests appear to come from ordinary homes rather than a single data centre. The software doesn't guess anything. It tries combinations it already holds and watches for the response that signals success: a redirect to a dashboard, a session cookie, or simply the absence of an error message.
Two things make this so effective. Volume, because a hundred thousand attempts that yield a few hundred working logins is still a good day for the attacker. And predictability, because the whole method assumes people reuse passwords. Attackers also slow down deliberately, spreading attempts across weeks so the traffic never looks like a spike.
It isn't brute force
Brute forcing means guessing: trying every possible combination until one works. Credential stuffing starts with real credentials from a real breach, which is why it slips past defences built to catch guessing, such as lockouts after five wrong attempts. When the password is correct on the first try, there's nothing unusual for the site to see.
Why Password Reuse Turns One Breach Into Many
When a site you used once gets breached, the damage should stop there. Reuse removes that boundary.
Think in terms of blast radius. If the pair from a forgotten recipe forum matches your main email account, the attacker now controls the inbox where every password reset link lands. From there, they can reset your banking login, your cloud storage, your domain registrar, anything that trusts your email for verification. That's why email accounts are the crown jewels in this kind of attack, and why securing yours matters more than tidying up a dozen lesser logins.
Small variations don't fix the problem. Password2023 becomes Password2024. You add a capital letter and an exclamation mark. Attackers' tools include rules that mutate known passwords in exactly those obvious ways, so a "brand new" version of an old password is often already on somebody's list.
Age matters too. A password you set years ago and never touched has had more time to appear in more breaches. The longer a reused password lives, the more lists it sits on.
The Warning Signs Are Usually Quiet
Credential stuffing rarely announces itself with a dramatic hack. What it leaves behind is a trail of small oddities. Watch for:
- Sign-in alerts for locations, browsers, or devices you don't recognise
- Password reset emails you didn't request, arriving in bursts
- Push notifications or multi-factor prompts that appear when you aren't logging in
- Being locked out of an account for "too many attempts"
- Messages sent to your contacts that you never wrote
- New forwarding rules, recovery addresses, or app passwords you didn't add
- Profile changes, orders, or settings edits you never made
Any single one of these can be a false alarm, like someone mistyping their own address. If two or more show up together, treat it as real and act the same day.
What to Do About It
- Fix your email account first. It's the reset route for everything else, so make it the strongest login you own.
- Use a password manager. It generates long random passwords and remembers them, which removes the only real reason people reuse: convenience.
- Replace reused passwords with unique ones, starting with banking, email, cloud storage, work accounts, and anywhere that stores a card number.
- Turn on multi-factor authentication. An authenticator app or a hardware key is stronger than text-message codes, and passkeys are stronger still where a site offers them. MFA doesn't stop the attacker from having your password, but it usually stops them from getting in.
- Review sessions and connected apps. Sign out of all devices, revoke anything unfamiliar, and check for mail forwarding rules.
- Sign up for breach alerts from a reputable notification service, so you learn about a leak from a warning rather than a fraud charge.
If an Account Was Already Hit
Work in order. Change the password, then sign out every active session so the attacker's copy of the login stops working. Check the recovery email address and phone number on the account, since attackers often swap those first to keep control. Look through connected apps and forwarding rules, then turn on multi-factor authentication before you do anything else.
If the same password guarded other accounts, change it everywhere it appeared. Never put the compromised password back into use, not even with a tweak. Warn your contacts if messages went out from your account, and contact your bank straight away if payment details were stored there. For anything involving money, identity documents, or a business account, follow the provider's security guidance and consider getting advice from a consumer protection body or a qualified professional before you decide on next steps.
Start With One Account Tonight
Pick your email account. Give it a long, unique password, ideally a string of random words you've never used before, and switch on multi-factor authentication. Then work down your list a few accounts at a time, saving each new password in a manager as you go.
It's a dull evening's work with an outsized payoff. Credential stuffing only functions because one stolen pair is worth testing everywhere. Break that assumption and those circulating lists stop being keys. They turn into noise.
Photo: Pexels / Pixabay
