Credential stuffing and account takeover
Why one reused password can unlock a dozen accounts. How attackers test leaked logins at scale, the signs your account was taken over, and how to lock it back down.
How it works
When a website is breached, the stolen email and password pairs end up in large lists. Attackers feed these lists into automated tools that try each pair on hundreds of other sites: streaming services, shops, email providers, banks, gaming platforms. Because so many people reuse passwords, a small percentage of attempts succeed, and at the scale of millions of attempts that is a lot of accounts.
This is credential stuffing. It does not require any skill to break into the target site; the site's own login page does the work, and the attacker simply logs in as you.
Related attacks
| Attack | Method | Stopped by |
|---|---|---|
| Credential stuffing | Real leaked username + password pairs tried on other sites | Unique passwords, 2FA |
| Password spraying | A few very common passwords tried against many accounts | Long passphrases, 2FA, lockouts |
| Brute force | Many guesses against one account | Rate limits, long passwords |
| Session hijacking | Stolen cookies from infostealer malware | Malware prevention, signing out sessions |
| SIM swap | Taking over your phone number for reset codes | Carrier PIN, app-based 2FA |
Signs your account was taken over
- Emails about a new sign-in, a password change, or a changed email address or phone number that you did not make.
- Orders, subscriptions, posts or messages you did not create.
- Saved payment cards used, or loyalty points and gift card balances suddenly gone. Points and gift cards are popular targets because they are rarely watched.
- Your password suddenly stops working.
Lock it back down
- Use the account's recovery process from the official site or app to reset your password. If the attacker changed your email address, use the service's "hacked account" support page.
- Sign out all other sessions and devices in the security settings.
- Check recovery options: email address, phone number, backup codes and connected apps. Attackers often add their own so they can come back.
- Turn on two-factor authentication or set up a passkey.
- Change the same password everywhere else you used it.
- Check your email account first if several accounts were hit. Whoever controls your email can reset everything else.
Prevention in three steps
- One account, one password. A password manager generates and remembers unique passwords for you.
- Two-factor everywhere it matters, starting with email, banking, social media and shopping accounts with saved cards. See 2FA and passkeys.
- Check for exposure with Have I Been Pwned and act on any matches.
Many modern password managers and browsers warn you automatically when a saved password appears in a known breach or is reused across sites. Turn that feature on.
