Credential Stuffing
An attack that automatically tries stolen username-password pairs from one breach across many other websites to find reused logins.
Credential stuffing↗ is an automated attack in which attackers take username and password pairs stolen from one data breach↗ and try them across many other websites, betting that people have reused the same login elsewhere. Because password reuse is so common, even a small percentage of successful matches can compromise a huge number of accounts.
Credential stuffing attacks are typically run with bots capable of testing thousands of login attempts per minute. Using a unique password for every account, ideally generated and stored by a password manager↗, completely defeats this attack since a leaked password becomes useless anywhere else.