Credential stuffing
password reuse attack · combolist · account takeover · ATO · bourrage d’identifiants
An automated attack that tries large numbers of username and password pairs stolen elsewhere against a site, betting that people reuse the same passwords.
In practice
Credentials from data breaches circulate in huge numbers as lists known as “combolists”. Bots try them against online shops, banks or corporate portals, spreading across many IP addresses to stay under the radar. The success rate is low, but over millions of attempts that is enough: every account taken over gives access to data, loyalty points or a payment method.
Fictional case: an employee uses the same password for a gardening forum that was breached and for their work email. A bot tries the pair on the webmail portal; with no multi-factor authentication, the attacker reads the inbox and prepares a payment fraud.
How to protect yourself
- Multi-factor authentication on every internet-facing login, ideally with passkeys.
- Ban password reuse and give staff a password manager.
- Detect and slow down automated logins (rate limiting, analysis of failed attempts).
- Reject new passwords that appear in lists of breached passwords.
