Credential Stuffing Attacks And What They Mean For Businesses

Over the past few months, Cooley's incident response team has seen an increase in "Credential Stuffing" attacks. Credential Stuffing is an account takeover attack in which actors obtain user names and passwords available on the dark web from prior data breaches, and then attempt to login to various online accounts using the credentials. This type of attack differs from a credential cracking or brute force attack, which involves attempting multiple passwords for a single account until successful. Here attackers use scripts or other automated means to run stolen credentials against their targeted online accounts. Inevitably some of the stolen usernames and passwords still work. In this post, we discuss the nature of these attacks, the recent increase in the frequency of these attacks and how best to respond to them and mitigate business impact.