Credential stuffing attack

Detection signals

• Sudden spike in login attempts with an abnormally high failure rate
• Traffic from many IPs, data-center ASNs, or rotating residential proxies
• Rise in 'account locked' and password-reset events
• Logins succeeding on old or weak passwords across unrelated accounts

Likely root causes

• Third-party breach exposing credentials your users reused
• No rate limiting or bot defense on the login endpoint
• Password-only authentication with no breached-password checks

Containment

1. 1Enable or tighten rate limiting on login and token endpoints
2. 2Turn on bot detection / CAPTCHA challenge for suspicious traffic
3. 3Block or throttle offending IP ranges and data-center ASNs
4. 4Enable breached-password (k-anonymity) checks to reject known-leaked passwords
5. 5Force step-up MFA on risky logins and new devices

Customer communication

• Notify affected users whose accounts show successful suspicious logins
• Recommend a password change and MFA enrollment, without implying your systems were breached if they were not
• Publish a status note if login was degraded for legitimate users

Forensics & logging

• Preserve authentication logs (IP, user agent, device, outcome, timestamp)
• Identify the set of accounts with successful unauthorized logins
• Correlate against known breach corpora if available

Post-incident hardening

• Make MFA the default and accelerate passkey adoption to kill password replay
• Keep breached-password checks on permanently
• Add adaptive risk scoring to the login path

FAQ

How do I tell credential stuffing from a normal traffic spike?

Credential stuffing shows an abnormally high login-failure rate from many IPs and data-center ASNs, plus a rise in lockouts and resets. A legitimate spike keeps a normal success rate.

What stops credential stuffing long-term?

Killing password replay: make MFA the default, adopt passkeys, and keep breached-password checks on permanently. Rate limiting and bot defense contain an attack; passwordless prevents the next one.