The Credential Stuffing Attack Your Security Tools Won't Catch

On July 22, Chick-fil-A notified customers of a breach that happened in June. Attackers did not crack Chick-fil-A's systems. They logged in using valid email addresses and passwords that customers had reused from accounts breached somewhere else, months or years ago. That is credential stuffing. And it is almost certainly running against your business accounts right now.

What Credential Stuffing Actually Is

Credential stuffing is not hacking in the traditional sense. It is account takeover using someone else's work.

When another company gets breached, its stolen email and password combinations end up on dark web markets within days. Those credentials get compiled into massive lists and run through automated bots against every web login attackers can reach. Microsoft 365. QuickBooks Online. Your CRM. Your payroll platform. Your bank portal.

According to research from Synthient and Have I Been Pwned, approximately 2 billion unique email addresses circulate in active credential stuffing lists today. Verizon's 2025 Data Breach Investigations Report found that the median share of authentication attempts classified as credential stuffing across enterprise single sign-on logs is 19 percent. Nearly one in five login attempts at a typical business service is an attacker testing a stolen password.

The attacker runs each credential pair once per service, slowly. Slow enough to stay under rate-limiting thresholds. Slow enough to look like normal user traffic.

Why Your Current Security Tools Miss It

This is where most business security spending has a gap nobody advertises.

Endpoint protection tools, whether they use machine learning or traditional signatures, protect devices from malware. They monitor what runs on your machines. Credential stuffing does not run on your machines. The attacker tests your employee's email and password against your Microsoft 365 portal from their own server. Your endpoint tool has no visibility into that transaction.

AI-powered email security scans incoming messages for phishing and malicious attachments. It is not watching who successfully logs into your cloud accounts from an unexpected IP address in Eastern Europe at 3am.

Some identity platforms include anomaly detection for logins. Most growing businesses either do not have those tools configured, do not receive actionable alerts when they fire, or have no defined process for responding outside business hours. A successful credential stuffing login looks, at first, exactly like a normal user session. The attacker is using real credentials. There is nothing inherently suspicious until behavioral patterns accumulate.

This is why MFA is not optional. It is the single countermeasure that stops the attack regardless of what else is or is not in your security stack.

The Supply Chain Behind Your Leaked Password

By 2026, credential stuffing has become its own industry, not a single attack.

One actor steals credentials through phishing, malware disguised as legitimate software, or breach dumps from compromised vendors. Another organizes the raw data into usable combo lists, filtered by service, freshness, and industry. Another validates which accounts still work. Another sells access. Another monetizes the takeover through fraud, data theft, or resale.

Your employees have, statistically, reused at least one password somewhere. The Verizon 2025 DBIR found that only 49 percent of a typical user's passwords are distinct across services. Half of all passwords get reused. One breach at a company they signed up with five years ago, a streaming service, a shopping site, a fitness app, puts your business accounts in play today.

You do not need to get breached yourself for credential stuffing to hit your business. You need one employee to have reused a password. That is it.

What Actually Stops It

Three practices stop credential stuffing. All three require active management. None involve sophisticated AI.

Multi-factor authentication across all applications. MFA stops credential stuffing because the attacker has the password but not the second factor. The common failure is incomplete coverage. Most businesses enable MFA on email and assume they are protected. Every other application with its own web login, the accounting platform, the payroll system, the project management tool, the banking portal, is a separate attack surface. If MFA is not enforced there, the credential pair still gets in.

Dark web monitoring for your domain. Services that continuously scan underground credential markets for your company's email domain alert you when employees' passwords surface. The alert is only useful if someone acts on it. Acting means forcing a password reset on the affected account, reviewing login history for unauthorized active sessions, and checking whether the same password was reused on other business systems. This is an ongoing process, not a one-time audit.

Password manager deployment and enforcement. Unique passwords per service mean a breach somewhere else does not cascade into your accounts. Getting a 40-person team to actually use a password manager, and enforcing it as policy rather than suggestion, is an IT management task. Most businesses that try to roll this out without active support from their IT team see adoption well under 50 percent.

The broader point is this: the limits of AI security tools show up most clearly in the response layer. Monitoring, policy enforcement, alert triage, and incident response are where the managed IT relationship earns its keep. Not the tools themselves.

What the Chick-fil-A Timeline Tells You

Attackers hit the Chick-fil-A One loyalty portal on June 17 and 18. The company did not determine that accounts were compromised until July 13. Nearly four weeks passed between the attack and its detection. Public disclosure came July 22.

Growing businesses face the same window. Customer portals, internal applications, cloud platforms. Any account accessible from the web is a target. Detection windows for credential stuffing, even at large enterprise scale, routinely run days to weeks. The playbook that hit Chick-fil-A does not stop at consumer-facing brands.

The businesses that avoid account takeovers are not running better AI tools. They are running MFA on every application, monitoring for dark web exposure on their domain, and enforcing unique passwords across systems. Those three practices, consistently managed by a team that knows how to act on alerts, close most of the gap.

Frequently Asked Questions

What is the difference between credential stuffing and brute force attacks?

Brute force attacks generate random password guesses against a specific account. Credential stuffing uses real email and password pairs stolen from previous breaches at other companies. Brute force shows up quickly as a spike in failed login attempts. Credential stuffing uses valid credentials and often looks like normal traffic until behavioral anomalies accumulate over time.

How do I know if my business credentials are on the dark web?

Dark web monitoring services scan underground markets continuously for email addresses and passwords tied to your company domain and alert you when new credentials appear. Your IT partner can run an initial check and set up ongoing monitoring. Have I Been Pwned (haveibeenpwned.com) offers a free domain search as a basic starting point, though it only captures publicly disclosed breaches.

Does MFA actually stop credential stuffing?

Yes, consistently. When MFA is enforced on an account, an attacker with the correct username and password still cannot complete the login without the second factor. The critical detail is coverage. MFA on email only leaves every other web-accessible business application exposed to the same attack.

What should my business do if employee credentials show up on the dark web?

Force an immediate password reset on the affected account. Review login history for unauthorized sessions and terminate any active ones. Check whether the same password was reused on other business accounts and reset those too. Confirm MFA is enabled on every affected account before restoring normal access.

Is credential stuffing targeted at specific businesses?

Usually not initially. Attacks run automated bots against login portals broadly, testing millions of credential pairs across any service they can reach. Targeting becomes more intentional after a successful takeover, when a compromised business account with administrative access gets sold for follow-on attacks. That secondary market is what makes a single compromised account at a 50-person firm worth far more than a consumer loyalty account.