We have heard time and time again that we should not reuse
passwords across accounts—if a cybercriminal were to obtain
access to the password of one account, they could then use such
password to access multiple accounts. This use of stolen passwords
and other credentials has led to a rise in credential stuffing
attacks. A new
guide released this month by New York Attorney General Letitia
James investigates the rise in credential stuffing attacks and best
practices designed to prevent such attacks.
What is a credential stuffing attack?
A credential stuffing attack uses stolen usernames and passwords
to repeatedly attempt to log into online accounts. Cybercriminals
often use free, automated software or “bots” that are
capable of cycling through hundreds or even millions of login
attempts simultaneously without manual input. Once a cybercriminal
successfully logs into an account, they can make purchases using a
credit card saved to the account, steal a gift card
