closeup photo of turned-on blue and white laptop computer

What is credential stuffing and why does password reuse make it devastating?

Every time a company is hacked and its user database stolen, the credentials don’t disappear — they enter a thriving underground marketplace called the breach economy. Lists of email/password pairs are bought, sold, merged, and redistributed across criminal forums at scale. In just the 12 months from April 2024, researchers found 19 billion compromised passwords published online across 200 security incidents — and that’s only counting breaches where email addresses accompanied the passwords. Between 2004 and 2025, passwords were the most frequently leaked data type in US breaches, with over two billion passwords exposed in that period alone.

In late 2025, security researcher Troy Hunt added 1.3 billion unique passwords to the HaveIBeenPwned database, aggregated from multiple credential stuffing sources shared by threat actors. These aren’t hypothetical — they’re real credentials sitting in lists, ready to be automated against login forms.

How credential stuffing actually works

Credential stuffing is the replay of breached username/password pairs across sites to find accounts where passwords have been reused. The attack has four steps:

  1. Get credentials — purchase or download a breach dump. Lists of millions of email/password pairs cost very little on criminal marketplaces.
  2. Automate login attempts — tools designed specifically for this feed the credential list into login forms automatically, often using rotating proxies to avoid IP-based blocks.
  3. Distribute globally — requests are spread across thousands of IP addresses to evade rate limiting and geographic detection.
  4. Harvest successes — any login that succeeds is logged. The attacker now has verified access to that account.

Because resources are cheap and widely available, it can cost as little as $200 to take over 1,000 accounts via credential stuffing. The economics are brutal — low cost, high yield, completely automated.

Why password reuse is the critical enabler

The attack only works because people reuse passwords. If every account had a unique password, a breach at Site A would have zero value for attacking Site B. But the reality is most people don’t use unique passwords everywhere.

The maths of why this matters: if you use the same password across 20 services and one of those services is breached, attackers now have a working key to potentially 19 other accounts. The more accounts share a password, the more valuable a single breach becomes — not just to the original attacker, but to everyone they sell the list to afterwards.

What attackers do with compromised accounts

The impacts of a successful credential stuffing attack include account takeover, fraud and financial losses, hijacking email to facilitate business email compromise, using account permissions and relationships to spread malware, and downloading account data to abuse or sell.

For WordPress sites specifically, a compromised admin account is catastrophic — attackers can install backdoors, redirect traffic, steal customer data, or silently use the server for spam and cryptomining.

The 2025 scale of the problem

In May 2025, researcher Jeremiah Fowler discovered an unprotected database exposing over 184 million records including email addresses, passwords, and login links in plain text, tied to major platforms including Apple, Google, Facebook, and Microsoft. The origin of the database was never traced — meaning it was almost certainly a compiled credential stuffing list built from multiple breaches.

A 2025 analysis of 2 billion passwords leaked on breach forums found that “123456” still topped the list with over 7.6 million accounts using it — evidence that despite years of awareness campaigns, the most predictable passwords remain extraordinarily common.

Defences — for users and site owners

For users:

  • Use a unique password for every account — a password manager makes this practical
  • Enable MFA wherever available — even if credentials are stuffed, MFA blocks access
  • Check haveibeenpwned.com regularly to see if your email appears in known breaches
  • Never reuse your email provider password anywhere else — email account access enables password resets on everything

For WordPress site owners:

  • Limit login attempts — plugins like Limit Login Attempts Reloaded or WP Cerber block automated stuffing tools
  • Enforce MFA for all admin accounts
  • Use login URL obfuscation — moving /wp-login.php to a custom path reduces automated targeting
  • Monitor for unusual login patterns — multiple failed attempts from diverse IPs is a stuffing signature
  • Consider a Web Application Firewall (WAF) — Cloudflare and similar services detect and block stuffing traffic patterns at the network level

The key insight is that credential stuffing isn’t a sophisticated attack — it requires no skill, just automation and a purchased list. The defence is equally straightforward: unique passwords and MFA make stolen credentials worthless.