Credential stuffing

Credential stuffing is an attack in which criminals take emails and passwords from a breach and try them automatically, with bots, across hundreds of different services. It relies on a widespread habit: using the same password on several accounts. If your password for a shop matches the one for your email or bank, a single stolen record is enough to get into all of them. Unlike brute force, it does not guess the password —it reuses one it already knows. The defense is clear: a unique password per service, generated and stored by a manager, plus two-factor authentication as a safety net. How to avoid it with the right tool is covered in the best password managers comparison.