What is Credential Stuffing?
Credential stuffing is a type of cyberattack in which scammers use credentials stolen in a previous data breach to login to another unrelated service. The frequency of this type of attack is growing exponentially and is becoming more sophisticated.
Scammers aggregate lists of username and password combinations sold on the dark web. Using the credentials lists, they use automation to run thousands of combinations in login attempts, hoping that customers have re-used the same login credentials on another account platform. For example, an attacker may take the list of usernames and passwords obtained from a data breach at a major
department store and use the same login credentials to attempt to log in to your bank account. This is why it is so critical to not reuse passwords across multiple accounts.
How do you know if your account has experienced this kind of attack?
Generally, you would have experienced one or more of the following situations:
- Your account was locked out.
- You received security notifications regarding failed login attempts or lockouts.
- You received unexpected authentication requests when you were not trying to access an account.
What preventive measures can you take?
Take these steps to ensure your accounts are protected:
- Never reuse passwords.
- Use a unique username other than your email address.
- Utilize a password manager to help you create, store, and remember long and unique passwords.
- Use special characters and a combination of upper- and lowercase letters and numbers in your passwords; or consider using a long passphrase.
- Never disclose your username or password to anyone. No legitimate business will call, text, or email you requesting this information.
- Check to see if your password has appeared in a data breach by doing a search on Have I Been Pwned.
- Change any compromised usernames or passwords. Always navigate directly to the company’s website to change your password. Do not use links sent in an email or text message unless
you initiated the reset request.
Your security is our top priority. We will never contact you asking for your financial or personal information. If you receive a message requesting sensitive information that claims to be from us, do not click any links and contact us directly.