What credential stuffing is and how leaked passwords open other accounts

You get an alert: access to your Netflix account detected in Bucharest, at 3 in the morning. You've never been to Romania. But the password was correct — so the system let it through. What happened wasn't a hacker guessing your password. It was a credential stuffing attack, and the blame most likely lies with a breach at some site you don't even remember signing up for.

What is credential stuffing?

Credential stuffing is a type of attack in which criminals take lists of username and password combinations obtained from old breaches and test them, automatically, against dozens of other services at the same time.

The logic is simple and devastating: if you used the same password on LinkedIn in 2012 (which leaked) and you use that same password today on your bank, your iCloud or your email, the attacker gets into all of those accounts without having to discover anything. The heavy lifting was already done by the original breach — they're just cashing in.

What's the difference between credential stuffing and a brute-force attack?

Brute force tests random password combinations; credential stuffing uses real username + password pairs stolen from previous breaches. In brute force, the attacker is shooting in the dark and needs many attempts per account — modern systems block that easily. In credential stuffing, every attempt looks like a legitimate login, with a real email address and a password that genuinely did belong to that user.

How the attack works, step by step

The cycle is well documented and starts long before the moment the alert shows up on your screen:

1. Credential collection: a breach happens — it could be a forum, an e-commerce site, a social network. The data ends up on dark web forums or gets sold in packages. There are currently around 24 billion username-password pairs circulating in underground databases, according to a 2026 Stingrai survey.
2. Cleaning and formatting: attackers filter the lists, remove duplicates and organize them into the format the automation tools expect.
3. Bot automation: tools like OpenBullet 2 (open source, publicly available) let them configure scripts that test thousands of logins a minute against a specific target — Netflix, banks, e-commerce, any service. Proxies and botnets distribute the requests to avoid IP blocking.
4. Harvesting accounts: even with a success rate between 0.2% and 2%, the numbers are absurd at scale. A list of 10 million credentials tested yields between 20,000 and 200,000 compromised accounts in a single campaign.
5. Monetization: the compromised accounts get sold, used for financial fraud, loyalty-point theft or access to other linked services.

In 2026, CyberFence estimates point to 26 billion credential stuffing attempts per month worldwide — growth of almost 50% in 18 months, driven by the proliferation of infostealers that grab credentials straight from the victim's device.

Real examples: when the attack made headlines

Credential stuffing isn't theory — there are documented cases with numbers confirmed by the victims themselves:

• Nintendo (2020): around 160,000 accounts were accessed via credential stuffing after an external breach. Nintendo publicly confirmed the incident and forced a mass password reset.
• Zoom (2020): during the remote-work boom, approximately 500,000 Zoom credentials appeared on underground forums — a combination of data from earlier breaches tested against the platform.
• Dunkin' Donuts (2018 and 2019): the coffee chain suffered two separate credential stuffing attacks, with accounts in the DD Perks loyalty program compromised.

Those cases have something in common: the services attacked weren't breached directly. The data came from somewhere else.

Why does it work so well?

Credential stuffing's success depends on a habit most people keep: reusing the same password across several services. Research in 2026 shows that more than 80% of users repeat passwords — and that the average number of services sharing the same password reaches four per user.

The other factor is the sheer abundance of data. Every major new breach — and they happen regularly — feeds the credential stuffing lists. If you've checked whether your email showed up in a breach using Have I Been Pwned and found that it did, your old credentials may already be running through these tools.

Phishing feeds the cycle too: successful phishing attacks hand attackers fresh credentials, which they then use both for direct access and as raw material for new credential stuffing campaigns against other services.

How to protect yourself from credential stuffing

The good news is that the defense is simple — hard to keep up, but simple to understand:

1. A unique password per service (there's no shortcut here)

If every service has a different password, a breach at one of them doesn't compromise the others. It doesn't matter how many billions of credentials are circulating — if your Netflix password isn't your bank password, the attack stops at the first barrier.

2. A password manager

Nobody remembers 50 unique, complex passwords. A password manager (Bitwarden, 1Password, KeePass) generates and stores long, unique passwords automatically. You only have to remember one — the master password.

3. Two-factor authentication (MFA) — the attack's handbrake

Even if the attacker has your correct username and password, MFA blocks access. A TOTP code generated by Google Authenticator or Aegis, a physical security key, or even SMS (less secure, but still better than nothing) blocks access even with valid credentials. Turn 2FA on everywhere that allows it, starting with email and banking.

4. Monitor your email addresses against breach databases

Regularly checking whether your email has shown up in a breach is basic digital hygiene. The complete guide to Have I Been Pwned explains how to do it — and what to do when the result comes back positive.

5. Passkeys: the passwordless future

Credential stuffing depends on passwords existing. Passkeys — the FIDO2 standard Google, Apple and Microsoft are adopting — replace the password with a local cryptographic key. With no password to steal, there's nothing to stuff. It isn't everywhere yet, but migrating what already supports it is a smart move.

Does a VPN protect against credential stuffing?

No. A VPN encrypts your traffic and hides your IP, but that has nothing to do with credential stuffing. The attack doesn't depend on intercepting your connection — it uses data that already leaked. If your credentials are in circulation, changing your IP changes nothing. The point of protection is the password and MFA, not the route of the connection. To understand exactly what a VPN protects (and what it doesn't), it's worth reading this straightforward analysis of the subject.

Conclusion

Credential stuffing is the attack that lives off past carelessness: reused passwords, forgotten breaches, old accounts never deactivated. The scale is industrial — 26 billion attempts a month — and the success rate, low as it is, produces hundreds of thousands of compromised accounts per campaign.

The protection is proportional to how simple the habit change is: a unique password per service + MFA already eliminates the overwhelming majority of the risk. If you're not using a password manager yet, that's the concrete next step. And if you want to understand the broader picture of keeping your digital privacy consistent, the privacy and OPSEC guide covers that ground in detail.