Credential stuffing

An attack that takes usernames and passwords leaked from one website and automatically tries them on other sites, exploiting people who reuse the same password.

Every year, large numbers of usernames and passwords are exposed through data breaches and then shared or sold online. Attackers load these lists into automated tools and try them against email services, banking sites, cloud apps and remote access portals. If an employee used the same password for a shopping site and their work email, a breach at the shopping site can become a breach at your business.

Credential stuffing is effective because password reuse is so common, and the logins look legitimate since the password is correct. For a small business, a single compromised mailbox can lead to fraudulent invoices, phishing sent to clients and exposure of personal information.

Practical tip: give staff a business password manager so they can use a unique password for every account without having to remember them all. Combine that with multi-factor authentication, which stops most credential stuffing attempts even when the password is right. Consider monitoring services that alert you when company email addresses appear in known breaches.