Credential Stuffing: Cyber Best Practices From NY Attorney General's Latest Report

In guidance released last week, the New York State Office of the Attorney General urged businesses to incorporate safeguards to detect and prevent credential-stuffing attacks in their data security programs.  The guidance stemmed from the AG's finding that 1.1 million customer accounts at "well-known" companies appeared to have been compromised in credential-stuffing attacks.

Credential stuffing refers to an attack where a hacker uses stolen usernames and passwords, or "credentials," from an online service that has suffered a data breach to access other online services, according to the AG's report.  Attackers exploit the habit of some consumers to reuse their passwords across multiple websites.  Attackers may also use automated software to initiate login attempts using stolen credentials from the dark web.