After a data breach at an online shop or forum, the stolen credentials often circulate quickly. Attackers try these pairs automatically on email services, Microsoft 365, online shops or citizen portals. Anyone who reuses their password becomes a target this way, even if the actual service was never hacked. The MITRE ATT&CK knowledge base lists the method as technique T1110.004, and the OWASP project on automated threats lists it as OAT-008.
How does credential stuffing work?
- Obtaining data: Credentials come from earlier data breaches at other services, from phishing or from malware.
- Automated trial: Programs send large numbers of login attempts, often distributed across many IP addresses so that simple blocks do not take effect.
- Exploiting hits: Working accounts are used for fraud, spam, data theft or as an entry point into the corporate network.
Distinction: brute force and password spraying
OWASP distinguishes three patterns. In a brute-force attack, many passwords are guessed against one account. In password spraying, one common password is tried against many accounts to avoid account lockouts. Credential stuffing does not guess but uses real, already stolen pairs.
In practice for SMEs and municipalities
Two sides are at risk. Your employees may use the same password privately and at work. A leak at a private service then opens the company account. Your own portals, such as an online shop, a customer area or a municipality's citizen service, can become the target of automated login attempts. In both cases: a password alone is no longer sufficient protection.
Measures against credential stuffing
- Multi-factor authentication: OWASP names MFA by far the best defense. Passkeys are the strongest, because a reusable password is no longer needed. For push methods, protection against MFA fatigue is part of it.
- Check passwords against leaks: The NIST guideline SP 800-63B in revision 4 from July 2025 requires new passwords to be checked against a blocklist of common, expected or compromised passwords.
- Unique passwords: A password manager makes different, long passwords for every account practical in everyday use.
- Slow down login attempts: Rate limits, CAPTCHAs and checking device and connection characteristics make automated attacks on your own portals harder.
- Report anything unusual: Notify users about logins from new devices or locations.
- Monitor leaks: Leak monitoring shows whether credentials from your domain appear in publicly known data breaches. MITRE recommends resetting known compromised accounts as a precaution.
How TOMORIS relates
GRID.darkwatch supports the detection of exposed company data and credentials, classifies hits and translates them into concrete protective measures. GRID.pass supports controlled management of shared passwords with clear roles.