Credential Stuffing and Password Reuse: What Breach Data Actually Shows

Have I Been Pwned tracks well over 17 billion breached account records at this point, sourced from over a thousand individual breaches, a number so large it's easy to read past without registering what it actually means operationally: most people reuse the same handful of passwords across many accounts, so a breach at any one of those services hands an attacker a working credential list for every other service the same person uses. That's the entire mechanism behind credential stuffing, and it's why it remains effective without a single new exploit.

Why credential stuffing isn't brute-forcing

Brute-forcing tries many guessed passwords against one account. Credential stuffing does the opposite, it takes real, already-known username/password pairs, leaked from an unrelated breach, and tries them against a different target's login, betting purely on password reuse. The attacker isn't guessing anything; every credential in the list already worked somewhere. Automated tools distribute these login attempts across large botnets and residential proxy networks specifically to look like ordinary traffic from thousands of different users and locations, rather than one obvious flood from a single IP.

Why rate limiting alone doesn't stop it

A naive defense, lock an IP out after five failed logins, assumes the attacker is hammering one endpoint from one address. Credential-stuffing tooling is built around exactly that assumption failing: each login attempt can come from a different residential IP, spaced out, mimicking normal user behavior closely enough that per-IP rate limiting barely slows it down. And critically, a meaningful fraction of the attempts aren't even failures, when password reuse is high, a real percentage of the credential list simply logs in successfully, because the password genuinely is correct for that account too.

What works

• MFA on every account that supports it, even a stolen, 100% correct password fails without the second factor, which is the single highest-leverage control against this entire attack class
• Checking new and existing passwords against known-breached credential lists at signup and login, not just enforcing complexity rules that do nothing to stop a leaked real password from being reused
• Device and behavioral fingerprinting that flags a login from an unfamiliar device/location even when the password was correct, rather than trusting username+password alone as sufficient
• CAPTCHA or proof-of-work challenges triggered by anomalous login volume, not a blanket IP-based lockout that both attackers and legitimate users route around equally easily

Checking your own exposure

Our free Breach Check tool queries Have I Been Pwned directly to tell you whether a given email address has appeared in a known breach, the same first step any credential-stuffing defense starts from: knowing which of your own accounts' passwords are already circulating publicly. Pair that with our Password Strength Checker to confirm a replacement password is actually strong, not just different.

Where this fits in a broader assessment

Credential stuffing is an authentication-layer problem, which is exactly the surface our Cybersecurity Consulting engagements review, MFA enforcement, login anomaly detection, and whether rate limiting is actually tuned for distributed, low-and-slow attack patterns rather than a single noisy IP. For the related technique that specifically evades account-lockout thresholds by design, see password spraying, explained.