Topic starter
24/06/2026 9:19 pm
TL;DR: Credential stuffing reuses stolen usernames and passwords across multiple login systems, and 1Kosmos notes that 193 billion attacks were seen in 2020 alone, with fraud, account takeover, and further compromise following reused credentials. Password-first identity still breaks when attackers can automate valid login attempts at scale.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is a Credential Stuffing Attack?”.
By the numbers:
- 1Kosmos reports that there were 193 billion credential stuffing attacks in 2020 alone.
Key questions
Q: Why do password reuse and credential stuffing remain so effective?
A: They remain effective because many users still reuse passwords and many environments still accept credentials without enough contextual risk checks.
Q: How should security teams reduce credential stuffing risk across user and machine identities?
A: Use layered controls that limit credential reuse, strengthen authentication, and shorten the time a stolen secret remains useful.
Q: What are the signs that credential stuffing is already underway in an environment?
A: Common signs include rapid spikes in failed logins, repeated attempts from unfamiliar geographies, and simultaneous logins from disparate devices.
Practitioner guidance
- Reduce password reliance at high-risk entry points Prioritise passwordless or phishing-resistant authentication for customer, workforce, and administrative accounts where account takeover would create material loss.
- Add step-up checks for anomalous logins Require additional verification when logins originate from new devices, unusual geographies, or abnormal velocity patterns that fit stuffing automation.
- Harden account recovery flows Remove weak recovery shortcuts that let a valid login become durable control through email reset loops or predictable knowledge-based verification.
Bottom line: Credential stuffing works because stolen usernames and passwords can be replayed against many services until one login succeeds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:28 am
Password-first identity creates credential portability: the real governance flaw is not only weak secrets, but the assumption that a password can continue to function as a reliable identity proof after reuse elsewhere. Credential stuffing proves that a password is a transferable bearer secret, not a durable trust signal. Identity programmes that still centre their controls on password possession are governing the symptom, not the failure mode.
A question worth separating out:
Q: Should organisations replace MFA with passwordless authentication?
A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.
👉 Read our full editorial: Credential stuffing exposes the limits of password-first identity