An attack that uses usernames and passwords stolen from one breach to try logging in to many other websites automatically.
Credential stuffing works because many people reuse the same password across sites. Attackers obtain lists of leaked credentials, then use automated tools and botnets to test them against shopping sites, banking apps, email services, and streaming platforms. Even a small success rate across millions of attempts gives them access to many accounts.
For example, if a customer's password for an old forum is leaked and they used the same email and password for a food delivery app, attackers can log in, place orders with saved cards, or sell the account. It differs from brute force attacks, which guess passwords rather than reusing known ones. Defenses include multi-factor authentication, passkeys, rate limiting, bot detection, checking new passwords against known breach lists, and encouraging customers to use password managers.
A network of compromised computers or devices controlled remotely by an attacker, often used for spam, fraud, or DDoS attacks.
Brute Force AttackAn attempt to break into an account or decrypt data by systematically trying many possible passwords or keys until one works.
Password ManagerAn app that securely stores and fills in passwords, so you can use a strong, unique password for every account without memorizing them.
Passkeys replace passwords with phishing-resistant cryptography built into your devices. Here is how they work, how to start using them, and how businesses can roll them out.
Who sees your DNA after you mail the tube? Here's how consumer genetic data is stored, shared, sold and searched by police, and how to download and delete yours.
A prioritized security checklist built on free CISA, FTC and NIST guidance, ordered by what stops the most attacks for the least money.