What is credential stuffing?

Credential stuffing is an attack that tries stolen usernames and passwords on other services, relying on people reusing the same sign-in details. A password leaked from one website may therefore put another account at risk. Criminals do not need to guess a new password if an old one still works. 1

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. An attacker obtains login details from an earlier, unrelated breach. 1
  2. They try those details on another service. 1
  3. Reused passwords can let them access accounts and the information inside. 1

Real UK example

The ICO's June 2025 findings describe a credential-stuffing attack on 23andMe during 2023. The attacker used login details stolen in unrelated breaches. UK residents’ information was accessed.

The regulator identified missing security measures, including authentication and monitoring failures. The case demonstrates the risk of reused credentials without blaming customers for company failings. 1

Warning signs

  • Sign-in alerts for attempts you did not make. 1
  • An account is accessed after another service reports a breach. 1
  • Security details or account activity change unexpectedly. 1
  • You discover that you used the same password on several sites. 123

What to do now

  1. Change a reused or exposed password through the genuine service. 123
  2. Change it on every other account that shares it. 1
  3. Check important accounts for unfamiliar activity and use the provider’s recovery process if needed. 123

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 456
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 57
  • If someone is in danger, call 999. 7

How to protect yourself

  • Use a different password for every account. 123
  • Use a password manager to help create and store unique passwords. 123
  • Turn on two-step verification. It adds a check, not a promise that compromise is impossible. 123

Frequently asked questions

Is credential stuffing the same as guessing a password?

No. It uses credentials that were already stolen elsewhere. Password reuse is what makes them useful on another service. 1

Can credential stuffing cause a data breach?

Yes. The ICO found that credential stuffing led to unauthorised access to UK users’ information at 23andMe. 1

Does two-step verification make password reuse safe?

No. Keep unique passwords as well. The ICO recommends strong, unique passwords and multi-factor authentication together. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  2. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  3. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  4. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).