Credential stuffing is an automated attack that takes username-and-password pairs stolen from one breached website and replays them against hundreds of other sites — banks, email, payroll, government portals — betting that people reuse passwords. When the bet pays off, the attacker logs into a real account with a real password and no alarm: it looks like a normal login. Verizon's 2025 Data Breach Investigations Report finds stolen credentials remain the most common initial action in breaches worldwide (Verizon 2025 DBIR), and the odds keep rising because the supply of stolen passwords keeps growing. This guide explains how the attack works, why reused passwords carry it, and what a small business can do — including the training that turns staff into the last line of defence.
TL;DR
- Credential stuffing replays stolen username-password pairs across other sites; it succeeds wherever a password has been reused.
- It looks like normal logins — no links, no malware, nothing for email filters to catch.
- MFA on every business account is the control that breaks the attack; password managers remove the reuse that feeds it.
- Check staff and business emails against Have I Been Pwned to find exposed credentials proactively.
- A short monthly module on password and MFA hygiene beats an annual policy nobody remembers.
How credential stuffing works
The attack is industrial-scale trial and error:
- A breach happens somewhere else. Another website or service is compromised; millions of email-password pairs leak to criminal markets.
- Automation replays them. Bots feed the pairs into login forms across email providers, banks, payroll systems and SaaS tools — thousands of attempts per account.
- Reused passwords fall. Anywhere the person reused the same password, the login succeeds and the attacker is in — reading mail, redirecting payments, sending further phishing from a trusted address.
- The account is quietly farmed. Attackers favour staying hidden: forwarding rules, new payees, saved sessions. Some compromised accounts sit for months before anyone notices.
The scale is the point: even if only 1–2% of pairs work on any given site, millions of pairs means thousands of working logins. And because the logins use correct passwords, they look like the owner. That is what makes credential stuffing the quietest way into a business.
Why small Australian businesses are exposed
- Reused passwords across work and personal accounts. The password from a breached shopping site in 2019 still opens somebody's webmail today.
- Email is the master key. A compromised mailbox reads every invoice, every password reset, every supplier conversation — the raw material for payment-redirection fraud.
- Legacy systems without MFA. Not every business tool offers it, and not every team has turned it on where it exists.
- No breach monitoring. Most businesses find out from the damage, not from a list.
The defences, in order of impact
- Turn on MFA everywhere it is offered — email, accounting, payroll, CRM, domain registrar. A stolen password alone then gets the attacker a denial, not an entry. Prefer app-based or phishing-resistant methods over SMS where available.
- Kill reuse with a password manager. Unique, unmemorable passwords per site, generated and stored for staff — the single structural fix for the reuse problem. Getting staff to actually adopt one is a training problem, not a software one.
- Check exposure proactively. Have I Been Pwned lets you test business domains and staff emails against known breaches; treat any hit as a prompt to reset that password and review the account.
- Watch for the warning signs. Unexpected MFA prompts, new inbox rules, colleagues reporting odd emails from a real address — all are compromise signals. Deny unexpected prompts and report them.
- Train the reflex. Password hygiene, prompt denial and breach awareness are habits — built the same way as every other security habit: short monthly lessons, measured per person. Security awareness training carries the password and MFA modules; human risk reporting shows who is still reusing passwords or sleeping through MFA prompts.
- Assume exposure and rehearse the response. When an account does fall, speed limits the damage: reset credentials, revoke sessions, check forwarding rules. A security gap assessment shows which of these steps is missing before an attacker tests it for you.
Credential stuffing vs phishing vs brute force
| Credential stuffing | Phishing | Brute force | |
|---|---|---|---|
| The trick | Replay a real password from another breach | Trick the person into handing over a password | Guess every combination |
| Speed | Fast — automated across thousands of accounts | One crafted lure at a time | Slow and loud |
| What stops it | MFA + unique passwords | Trained verification reflex | Rate limiting, lockouts, strong passwords |
The overlap: the same stolen credentials often arrive by phishing too — the two attacks feed each other, and a workplace that trains against one should train against both. See what is phishing? for the other half of the pair.
What to do when an account is compromised
Move in this order, in the first hour: reset the password from a clean device, revoke all active sessions, check mailbox forwarding and rules for the attacker's trail, confirm MFA is still enrolled under your control, then tell IT and anyone who may have received mail from the compromised address. If payments or client data were touched, report to ReportCyber and alert the bank if money is involved.
FAQ
What is credential stuffing in simple terms? Attackers take usernames and passwords stolen from one breach and try them on other websites, because people reuse passwords. It works wherever the same password was used twice.
How is it different from phishing? Phishing tricks you into revealing a password; credential stuffing uses one you (or someone else) already lost. Both end with an attacker logged in as you — which is why MFA and unique passwords close both doors.
Does MFA stop credential stuffing? Almost entirely. With MFA on, a correct stolen password is not enough — the attacker also needs the second factor. SMS codes are weaker than app-based prompts but still far better than nothing.
How do I know if my business emails are in a breach? Check your domain and staff addresses at Have I Been Pwned. Any hit means those passwords should be changed immediately and MFA confirmed on.
What's the fastest fix for a small team? MFA on email and accounting first, a password manager for everyone second, then a short monthly training module to keep both habits alive.
One last thing
Credential stuffing succeeds on a maths problem, not a technology gap: one reused password multiplied by millions of stolen pairs. MFA and a password manager collapse the maths, and monthly training keeps both in place — the cheapest three controls a business will ever run.