Topic starter
09/07/2026 3:21 pm
TL;DR: Credential stuffing remains effective because attackers can automate millions of login attempts against reused credentials, and New York’s attorney general found more than one million accounts compromised across 17 well-known companies, according to Bitwarden. Password policy alone is not enough when account takeover can scale faster than user behaviour changes.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “New York Takes on Credential Stuffing and Passwords”.
Key questions
Q: What breaks when users reuse passwords across multiple services?
A: One exposed credential can become many compromised accounts.
Q: Why do password reuse and credential stuffing remain so effective?
A: They remain effective because many users still reuse passwords and many environments still accept credentials without enough contextual risk checks.
Q: How do security teams know if password lifecycle control is actually working?
A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination.
Practitioner guidance
- Enforce unique credentials across all user populations Require password managers where possible so users do not rely on memory or reuse across accounts.
- Add MFA to every externally reachable account Make multi-factor authentication mandatory for accounts that can be reached from the internet, especially consumer-facing and administrative portals.
- Monitor for automated login abuse Look for repeated failed logins, unusual geographic patterns, and account access bursts that do not match normal user behaviour.
Bottom line: Credential stuffing succeeds because reused passwords let attackers turn one exposed secret into many valid logins across unrelated services.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:40 pm
Password reuse is the primary control failure credential stuffing exploits. This is not mainly a password-strength problem, because even strong secrets fail when they are reused across services. The governance gap is that many authentication systems still assume a credential is meaningful only in its original context. Practitioners should treat reuse as a systemic exposure multiplier, not a user convenience issue.
A few things that frame the scale:
- Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
A question worth separating out:
Q: Should teams prioritise password managers or 2FA first?
A: If a programme has to choose, password managers address the root cause of reuse, while 2FA limits damage after compromise. In most environments, the best answer is to deploy both, but password managers usually improve the underlying behaviour that makes other controls more effective.
👉 Read our full editorial: Credential stuffing shows why password reuse still breaks account security