San Francisco State University

SCIENCE 2BP3For example, an attacker may take a list of usernames and passwords obtained from a breach of a
major department store, and use the same login credentials to try and log in to the site of a national
bank. The attacker is hoping that some fraction of those department store customers also have an
account at that bank, and that they reused the same usernames and passwords for both services.
Credential stuffing is widespread thanks to massive lists of breached credentials being traded and sold
on the black market. The proliferation of these lists, combined with advancements in credential
stuffing tools that use bots to get around traditional login protections, have made credential stuffing a
popular attack vector.
What makes credential stuffing effective?
Statistically speaking, credential stuffing attacks have a very low rate of success. Many estimates have
this rate at about 0.1%, meaning that for every thousand accounts an attacker attempts to crack, they
will succeed roughly once. The sheer volume of the credential collections being traded by attackers
makes credential stuffing worth it, in spite of the low success rate.
These collections contain millions and in some cases billions of login credentials. If an attacker has one
million sets of credentials, this could yield around 1,000 successfully cracked accounts. If even a small
percentage of the cracked accounts yields profitable data (often in the form of credit card numbers or