Credential stuffing is one of the most common and damaging attacks on the internet — and most people have never heard of it. Here is what it is, how it works, and how disposable email cuts your exposure.
Credential stuffing is what happens after a data breach — and it is far more dangerous than most people realise. When a service gets hacked and usernames and passwords leak, attackers do not just use those credentials on the breached site. They run them, automatically, against hundreds of other services: your bank, your email, your streaming accounts, your retail accounts. The attack works because most people reuse passwords.
How credential stuffing actually works
Attackers purchase or download breach databases — lists of millions of email and password pairs exposed in previous breaches. They run these through automated tools that try each combination against a long list of target websites simultaneously, distributing the requests across thousands of IP addresses to avoid rate limiting. The process is largely automated and can test millions of credential pairs per day.
How disposable email reduces your risk
- Different address per service: a stuffing attack needs a matching username. If every service has a different email, a leaked pair only works on the site it was stolen from.
- Abandoned credentials: for low-trust services, using a disposable address means nothing valuable is at stake if it leaks.
- Blast radius containment: even if a service with your disposable address is breached, the leaked address does not help attackers access anything else tied to your real identity.
Frequently Asked Questions
How do I know if I have been a victim of credential stuffing?
Watch for unexpected password reset emails, login alerts from unfamiliar locations, or being locked out of accounts you have not tried to access. If you receive such alerts, change the password for that service immediately, enable two-factor authentication, and audit other accounts using the same credentials.
Does 2FA stop credential stuffing?
Yes, in most cases. If an attacker has the right username and password but cannot pass the second factor, they cannot get in. 2FA is one of the most effective defences against account takeover.
Can a service tell if credentials were stolen?
Services with good security monitoring look for anomalous login patterns — new locations, high failure rates, unusual session behaviour — and may trigger additional verification.
#credential stuffing#account takeover#password reuse attack#email security#data breach protection
