His Gmail account was hijacked on a Tuesday morning. He logged in to find his inbox wiped, his recovery phone number changed, and a forwarding rule set up to a stranger’s address. The attacker had been reading his email for eleven days before making a move.
Here’s the part that didn’t make sense to him: he hadn’t been on the breached site. He’d signed up for a fitness app three years earlier, used it twice, and forgot it existed. That app got breached. His email and password leaked. He never got a notification. And his Gmail password was the same one.
This is credential stuffing: attackers take leaked email and password pairs and test them automatically, at scale, against every high-value site they can target. They don’t care which site leaked your credentials. They care only whether you reused the same password somewhere that matters.
You weren’t on that hacked site. Your account still got broken into.
Most people reason about breach risk the wrong way. They think: “I wasn’t on that breached platform, so I’m safe.” This is understandable, but wrong.
The attack isn’t targeted at the breached company’s users specifically. It uses the credentials from that breach as raw material and fires them at entirely different sites. Your email and password from a 2021 forum breach get tested against Gmail, Amazon, your bank, your PayPal, your airline account. If the password matches anywhere, the attacker is in.
The credential stuffing attack is why changing the password on the breached site is not enough. Every account using that password is now compromised — whether you remember having those accounts or not.
What a combolist is
When a company is breached, attackers steal the database. That database contains user records: email addresses paired with passwords. If the company hashed passwords weakly (using MD5 or SHA-1 without salting), attackers crack them quickly using precomputed tables. If the company stored passwords in plaintext — and many still do — the pairs are ready to use immediately.
These stolen pairs get sold or posted on dark web forums. Over time, multiple breach databases get combined, cleaned of duplicates, and formatted into a single massive file. That file is a combolist — a structured list of email:password pairs ready to be tested at scale.
The RockYou2024 combolist, published in 2024, contained nearly 10 billion credential pairs compiled from thousands of historical breaches. That’s not 10 billion accounts from one company. It’s a decade of breach data aggregated into a single file available to anyone who knows where to look.
Attackers don’t sit there typing credentials manually. They run software. Thousands of pairs per second, across hundreds of target sites, running overnight while they sleep.
How the attack runs
The tooling behind credential stuffing is freely available and requires minimal technical skill. OpenBullet and SilverBullet are open-source platforms that automate the entire process. Sentry MBA is a proprietary crimeware tool, sold privately in underground markets.
Here’s how an attack runs: an attacker downloads a combolist and a “config” file for the target site — say, Amazon. The config tells the tool exactly how Amazon’s login form works: which fields to fill, how to parse the response to determine success or failure, and how to handle multi-step authentication prompts. These configs are shared freely in attacker communities. There are thousands of them.
The tool rotates through residential proxy networks to distribute login attempts across thousands of different addresses. These are IP addresses belonging to ordinary home routers that have been compromised or rented. To Amazon’s servers, the login attempts look like they’re coming from thousands of different users in different countries.
Success rates on credential stuffing runs are typically 0.1–2% of pairs tested. That sounds small. On 10 billion records, that’s between 10 million and 200 million valid account logins — across whatever sites the attacker is targeting. Even the lower end of that range is an extraordinary return on automated effort.
Which accounts they target first
Attackers aren’t running stuffing attacks randomly. They prioritise by what an account is worth on the open market — or what it lets them access.
Email accounts come first. Your Gmail, Outlook, or Yahoo account is the master key. It receives password reset emails. Whoever controls your email can reset every other account attached to it. An email account with years of archived messages is also a goldmine for personal information: bank statements, address history, legal documents, private communications.
Financial services come second. Banking apps, PayPal, Venmo, Cash App, and crypto exchanges all let attackers move money directly. A validated bank login with an accessible balance is worth significantly more than a streaming account.
E-commerce accounts with stored payment methods — Amazon, eBay, Etsy shop accounts — let attackers make purchases and redirect them to a drop address. Your saved card is charged; you see the transaction days later.
Loyalty programme accounts are underestimated. Frequent flyer miles, hotel points, and retailer rewards can all be converted to cash. A high-balance airline miles account sells for real money — attackers transfer the points to their own account or sell the account credentials directly. These takeovers often go undetected for months because victims rarely check loyalty balances.
Streaming accounts (Netflix, Spotify, Disney+, Hulu) are the lowest tier. They sell for $1–3 on dark web marketplaces. The margin is thin, but the volume is high — millions of valid streaming credentials circulate constantly.
Why CAPTCHA and rate limiting don’t stop it
Sites know credential stuffing exists. They deploy defences: CAPTCHAs, rate limiting, anomaly detection. These help. They don’t stop determined attackers.
Rate limiting restricts how many login attempts a single IP address can make. Residential proxy networks sidestep this by distributing attempts across thousands of addresses — no single IP exceeds the limit.
CAPTCHAs are solved two ways: automated vision models (increasingly capable) and CAPTCHA-solving services that route puzzles to human solvers in real time. Those services charge $0.50–$2 per 1,000 solves. At that price, CAPTCHAs are a minor operating cost, not a barrier.
Anomaly detection can flag unusual login patterns — logins from new countries, multiple failures before success, device fingerprint mismatches. Better platforms do this well. But attackers pace their attempts and rotate devices precisely to stay inside detection thresholds.
Two-factor authentication is the only control that actually stops a credential stuffing attack. A valid email:password pair is not enough to get in if the account requires a code from your phone or authenticator app. The attacker has your password. They don’t have your device.
The detection problem for victims
You often don’t know your account has been accessed. Skilled attackers log in quietly, assess what’s in the account, and either use it immediately or sell the validated credentials. They don’t trigger obvious alarms. They don’t blast out phishing emails from your account immediately — that would get noticed. They wait, or they sell the access to someone else.
Many account takeovers sit undetected for weeks or months.
The signs to look for: password reset emails you didn’t request; login notifications from unfamiliar cities or countries; being unexpectedly locked out of an account you haven’t used recently; small unfamiliar charges on payment methods linked to e-commerce accounts; and loyalty balances that are lower than you remember.
You’re unlikely to notice any of these unless you’re already looking.
Real scale: how many accounts are compromised this way
This isn’t a niche attack affecting a small population. It’s the dominant method for monetising breach data at scale.
Akamai, which monitors login traffic across a large portion of the internet’s infrastructure, recorded 193 billion credential stuffing attacks in 2020 alone. Not attempts per user — 193 billion individual automated login requests across the sites they monitor. The numbers have grown since.
Credential stuffing remains one of the most prevalent automated attack vectors against financial accounts — because it’s automated, cheap, and the raw material (combolists) is abundant and free.
Every major breach feeds the next wave of stuffing attacks. The breach doesn’t have to be recent. RockYou2024 contains credentials from breaches going back over a decade. Your password from a 2017 breach is still being tested against your current accounts today.
The breach-to-stuffing timeline
The window between when your credentials are stolen and when you find out is much longer than most people assume.
A company gets breached. The attacker either sells the data exclusively to a small group of buyers first, or posts it immediately on a dark web forum depending on their motivation. Within days to weeks, combolists incorporating the new data start circulating. Automated stuffing runs targeting high-value sites begin within weeks of a significant breach.
Meanwhile, the breached company may not know it’s been breached. Discovery takes time. Forensics takes time. Regulatory notification timelines allow additional weeks or months before affected users hear anything.
IBM’s Cost of a Data Breach Report puts the mean time to identify a breach at 197 days — that’s just how long it takes the company to discover it happened. Individual notification often takes months longer. You are exposed for six months before you have any chance to act. Attackers have the data immediately.
The complete defence
These are ordered by impact. Do them in this order.
Use a unique password for every account. This is the only thing that completely eliminates credential stuffing risk. If each account has its own password, a breach at one site exposes exactly one site — nothing else. A password manager (see how to choose and use one) generates and stores unique passwords automatically. You remember one master password; it handles the rest.
Enable two-factor authentication on every account that offers it. Start with your email accounts, because that’s the master key. Add it to your bank, your PayPal, your Amazon, your Apple ID, and your Google account. An authenticator app (Google Authenticator, Authy, Aegis) is significantly stronger than SMS-based codes, which are vulnerable to SIM swap attacks. 2FA means a valid password is not enough to get in.
Monitor for breach exposure. Sign up for notifications at Have I Been Pwned (haveibeenpwned.com) for every email address you use. You’ll get an alert when any database containing your email appears in a new breach. See also: how to check if your data has leaked.
Check Have I Been Pwned right now. Go to haveibeenpwned.com, enter your email addresses — including old ones you haven’t used in years. If any appear in known breaches, treat every account using passwords from that period as potentially compromised and change them.
Review active sessions on your major accounts. Gmail, Facebook, Apple ID, and Google all show you every device and location where your account is currently logged in. Go check. If you see a session from a city you’ve never been in, or a device you don’t recognise, revoke it immediately.
Separate your email addresses by account tier. Use a dedicated email address for financial accounts and anything sensitive — don’t use it for website signups, newsletters, or services you don’t fully trust. If your signup email appears in a breach, your banking email remains clean.
None of these are difficult. The password manager takes an afternoon to set up. 2FA takes five minutes per account. These two changes alone — unique passwords and 2FA — make credential stuffing attacks against your accounts functionally impossible.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.