TLDR: Credential stuffing quick facts
Cyber criminals use stolen passwords from previous data breaches to access accounts on other websites, exploiting the fact that 85% of users reuse passwords.
26 billion credential stuffing attempts occur monthly worldwide, with even 1-2% success rates compromising thousands of accounts.
The North Face and Cartier both suffered breaches in 2025 when attackers used stolen credentials to access customer accounts.
Businesses face average losses of $4.81 million per successful credential stuffing breach, including regulatory fines and reputation damage.
Most people use the same password across multiple sites, creating a domino effect when one service is breached.
Top prevention methods:
- Use unique passwords for every account (password managers help)
- Enable multi-factor authentication (stops 99.9% of these attacks)
- Monitor for compromised credentials using breach detection services
- Implement rate limiting and behavioral analysis for businesses
Password reuse turns every external data breach into a potential threat to your personal accounts or business systems.
In April 2025, outdoor gear giant The North Face sent out an uncomfortable email to thousands of customers: “We are writing to inform you of a security incident that may have involved your personal information.” The culprit wasn’t a sophisticated zero-day exploit or state-sponsored hackers, it was something far more mundane yet equally devastating: credential stuffing.
Within weeks, luxury brand Cartier followed with a similar notification. Two household names, compromised by the same attack method that’s quietly becoming one of the most profitable tactics in cyber crime. Yet most people have never probably heard of it.
What is credential stuffing?
Credential stuffing is deceptively simple. Cyber criminals take lists of usernames and passwords stolen from previous data breaches and systematically try them across thousands of other websites and services. They’re betting on one fundamental human weakness: we reuse passwords.
Think of it as a master key approach to cyber crime. When hackers breach a social media site and steal millions of login credentials, they don’t just target that one platform. They take those same username-password combinations and test them against banks, shopping sites, email accounts and corporate systems.
The staggering scale of the problem
The numbers behind credential stuffing attacks are mind-boggling:
- 26 billion malicious login attempts happen globally every month through credential stuffing
- 85% of users admit to reusing passwords across multiple accounts
- Businesses face an average cost of $4.81 million per successful breach
- Even with just a 0.1-2% success rate, attackers can compromise thousands of accounts from a single campaign
To put this in perspective: if criminals test 1 million stolen credentials against a popular e-commerce site and achieve just a 1% success rate, they’ve successfully accessed 10,000 customer accounts. Each compromised account can be sold on dark web markets for $15-$50, making this an extremely lucrative enterprise.
Why these attacks are so devastatingly effective
The password reuse problem
Despite decades of security awareness campaigns, password reuse remains epidemic. Research shows that the average person maintains accounts on over 80 different online services but uses only 5-7 unique passwords across all of them. This creates a domino effect where a single compromised password can unlock multiple accounts.
Modern credential stuffing operations use sophisticated automation tools that can test thousands of login attempts per minute across multiple sites simultaneously. These tools rotate IP addresses, mimic human behaviour patterns, and can bypass basic security measures like simple rate limiting.
The stealth factor
Unlike brute force attacks that try random password combinations, credential stuffing uses real, previously valid credentials. This makes the login attempts appear legitimate to many security systems, allowing attacks to fly under the radar for extended periods.
For Individuals
When your credentials are successfully stuffed, the consequences cascade quickly:
- Financial theft: Direct access to banking and payment accounts
- Identity theft: Personal information used to open new accounts or make fraudulent purchases
- Privacy violation: Access to private communications, photos, and documents
- Reputation damage: Compromised social media accounts used to spread malware or inappropriate content
- Professional impact: Compromised work accounts leading to data breaches or corporate espionage
For Businesses
The business impact extends far beyond the initial security incident:
- Direct financial losses: Fraudulent transactions and theft of corporate funds
- Regulatory penalties: Fines for failing to protect customer data under GDPR and other regulations
- Legal liability: Lawsuits from affected customers and business partners
- Operational disruption: Time and resources spent investigating and responding to breaches
- Reputation damage: Lost customer trust and negative media coverage
- Competitive disadvantage: Intellectual property theft and exposure of business strategies
Credential stuffing has spawned an entire underground economy. Stolen credential databases are traded on dark web marketplaces, with prices varying based on the source and quality of the data. Recent breaches from financial institutions or healthcare providers command premium prices, while older social media credentials sell for pennies per account.
Criminal organisations have professionalised these operations, offering “credential stuffing as a service” to less technically sophisticated criminals. They provide the tools, the stolen data, and even customer support for their illegal enterprise.
Prevention strategies
For Individuals
1. Embrace unique passwords everywhere Every account should have a completely unique password. This breaks the chain reaction that makes credential stuffing possible.
2. Use a password manager Tools like Bitwarden or Keeper generate and store unique, complex passwords for every account. They eliminate the need to remember multiple passwords while ensuring maximum security.
3. Enable Multi-Factor Authentication (MFA) MFA stops 99% of credential-based attacks. Even if your password is compromised, attackers can’t access your accounts without the second authentication factor.
4. Monitor for compromised credentials Services like HaveIBeenPwned.com alert you when your email appears in known data breaches, allowing you to change passwords before they’re used against you.
5. Use strong, random passwords Passwords should be at least 12 characters long and include a mix of uppercase letters, lowercase letters, numbers, and symbols. Avoid common substitutions (like @ for ‘a’) that automated tools easily crack.
For Businesses
1. Implement enterprise password policies Require employees to use unique passwords for all business accounts and provide enterprise password managers to make compliance easy.
2. Deploy advanced authentication systems Move beyond simple MFA to risk-based authentication that analyses login patterns, device fingerprints, and behavioral biometrics to identify suspicious access attempts.
3. Monitor for credential compromise Subscribe to threat intelligence services that alert you when employee or customer credentials appear in data breaches or are being sold on criminal marketplaces.
4. Use rate limiting Implement progressive delays and challenges for repeated failed login attempts to slow down automated attacks.
5. Educate your workforce Regular security awareness training should specifically address password reuse and credential stuffing attacks, helping employees understand both personal and professional risks.
6. Implement zero-trust architecture Assume that credentials will eventually be compromised and design systems that continuously verify user identity and limit access based on the principle of least privilege.
The future of credential security
As credential stuffing attacks become more sophisticated, the security landscape is evolving rapidly. Emerging technologies like passwordless authentication, biometric verification, and blockchain-based identity management promise to eventually eliminate password-based vulnerabilities entirely.
However, these solutions are still years away from widespread adoption. In the meantime, the combination of unique passwords, password managers, and multi-factor authentication remains our best defence against this growing threat.
The North Face and Cartier attacks serve as a stark reminder that no organisation is immune to credential stuffing. Whether you’re an individual protecting personal accounts or a business safeguarding customer data, the time to act is now.
Start with these immediate steps:
- Audit your current passwords – Identify and change any reused passwords across your accounts
- Install a password manager – Begin generating unique passwords for new accounts and gradually update existing ones
- Enable MFA everywhere possible – Prioritise financial accounts, email, and any accounts containing sensitive information
- Check for compromised credentials – Search your email addresses on breach monitoring sites
The criminals behind credential stuffing attacks are counting on our complacency and poor password habits.
By taking proactive steps to secure our digital identities, we can turn their billion-dollar business model into a significantly less profitable endeavour.
In cyber security, the best defence is often the simplest one: unique passwords, properly managed, with multi-factor authentication enabled. It’s not glamorous, but it works and that’s what matters most.
