23andMe Lost Everything — Starting with Recycled Passwords

In October 2023, genetic testing company 23andMe confirmed that a credential stuffing attack compromised roughly 6.9 million user accounts. Attackers didn't exploit a zero-day vulnerability or deploy sophisticated malware. They simply took usernames and passwords stolen from other breaches and tried them against 23andMe's login page. It worked — because millions of people reuse the same password everywhere.

The fallout was catastrophic. Sensitive genetic data was exposed, the company's stock cratered, and by 2024 23andMe agreed to a $30 million settlement. The company ultimately filed for bankruptcy in 2025. All because of a threat that's been well understood for over a decade.

If you think your organization is immune to this kind of attack, I'd encourage you to keep reading. I've watched companies of every size — from startups to Fortune 500s — get hit by credential stuffing. The pattern is always the same, and the fix is entirely within reach.

What Exactly Is a Credential Stuffing Attack?

A credential stuffing attack is an automated cyberattack where a threat actor takes large lists of stolen username-password pairs and systematically tests them against other websites and applications. The attacker is betting that users have reused their credentials across multiple services — and that bet pays off far more often than most security teams want to admit.

These credential lists come from previous data breaches. Billions of username-password combinations are available on dark web marketplaces and paste sites. Tools like Sentry MBA, OpenBullet, and custom scripts let attackers test thousands of login attempts per minute against virtually any web application.

Credential Stuffing vs. Brute Force: They're Not the Same

People confuse these two constantly. A brute force attack tries random or systematically generated password combinations against a single account. A credential stuffing attack uses known, previously valid credentials and tests them at scale across different services. Brute force is guessing. Credential stuffing is recycling — and it's far more efficient.

According to the Verizon 2024 Data Breach Investigations Report, stolen credentials were involved in over 31% of all breaches over the past decade. That's not a niche problem. That's the most consistent attack vector in cybersecurity.

Why Credential Stuffing Works So Devastatingly Well

The math is simple and brutal. Studies consistently show that roughly 65% of people reuse passwords across multiple accounts. When a major breach dumps millions of credentials — think LinkedIn in 2012, Yahoo in 2013, or the massive Collection #1 dump of 773 million email addresses in 2019 — attackers get an enormous inventory to test.

Even a 1-2% success rate on credential stuffing attempts translates to thousands of compromised accounts when you're testing millions of pairs. And attackers don't need to be selective. They automate the process, rotate through proxy networks to dodge IP-based rate limiting, and let their bots run around the clock.

The Business Impact Goes Beyond the Breach

Once attackers gain access to accounts, the damage cascades fast:

  • Account takeover (ATO): Attackers change passwords, drain funds, or make fraudulent purchases.
  • Lateral movement: If an employee reuses their corporate password on a compromised consumer site, attackers now have a door into your enterprise network.
  • Data exfiltration: Personal data, financial records, and intellectual property get siphoned before anyone notices.
  • Regulatory penalties: Under GDPR, CCPA, and other frameworks, failure to protect user credentials can trigger significant fines.

I've worked with organizations that discovered credential stuffing compromises months after the initial access. By that point, the attacker had moved laterally, escalated privileges, and positioned themselves for a ransomware deployment. The credential stuffing attack was just step one.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. Breaches involving stolen or compromised credentials took an average of 292 days to identify and contain — the longest of any attack vector. That's nearly ten months of an attacker operating inside your environment.

The longer an attacker stays undetected, the more expensive the breach gets. And credential stuffing is inherently stealthy. The attacker is logging in with valid credentials. There's no malware signature, no exploit chain, no alert from your endpoint detection tool. To your systems, it looks like a legitimate user.

How to Defend Against Credential Stuffing Attacks

I've helped dozens of organizations build defenses against credential stuffing. Here's what actually works — not in theory, but in practice.

1. Enforce Multi-Factor Authentication Everywhere

Multi-factor authentication (MFA) is the single most effective control against credential stuffing. Even if an attacker has a valid username and password, they can't complete the login without the second factor. CISA explicitly recommends MFA as a foundational security measure for all organizations.

Push-based MFA or hardware security keys (FIDO2) are far stronger than SMS-based one-time codes, which are vulnerable to SIM-swapping attacks. If you haven't deployed MFA across all critical systems and user-facing applications, that's your number one priority.

2. Deploy Credential Screening Against Known Breach Databases

NIST Special Publication 800-63B specifically recommends checking user passwords against lists of commonly compromised credentials. Services like Have I Been Pwned's API or built-in Azure AD password protection let you block users from setting passwords that already appear in breach dumps. This reduces the pool of credentials attackers can successfully recycle.

3. Implement Bot Detection and Rate Limiting

Credential stuffing relies on automation. Deploying CAPTCHA challenges, behavioral analytics, and intelligent rate limiting on login endpoints disrupts automated tooling. Look at the volume of failed login attempts from specific IP ranges, ASNs, or geographies. Legitimate users don't attempt 500 logins per minute from rotating residential proxies.

4. Adopt a Zero Trust Architecture

Zero trust means never assuming a session is legitimate just because the credentials were correct. Continuously verify user identity, device posture, and behavioral patterns throughout each session. If a user who typically logs in from Chicago suddenly authenticates from a VPN exit node in Eastern Europe at 3 AM, that session should trigger additional verification — even if the password was correct.

5. Train Your People — Because They're the Root Cause

Password reuse is a human behavior problem. No technical control eliminates it entirely. Your employees and users need to understand why reusing passwords is dangerous and how credential stuffing attacks exploit that habit.

Effective cybersecurity awareness training covers password hygiene, password manager adoption, and the social engineering tactics attackers use to harvest credentials in the first place. Pair that with regular phishing awareness training for your organization to reduce the credential theft that feeds credential stuffing attacks downstream.

What About Passkeys? Are Passwords Finally Dying?

Passkeys — based on the FIDO2/WebAuthn standard — eliminate passwords entirely for supported services. Instead of a shared secret that can be stolen and replayed, passkeys use public-key cryptography tied to a specific device. There's nothing for an attacker to stuff.

Major platforms including Google, Apple, and Microsoft now support passkeys, and adoption is growing. But we're years away from universal coverage. Legacy applications, third-party SaaS tools, and internal enterprise systems still rely on passwords. You can't wait for passkeys to save you. Build your defenses around the reality of today.

A Quick Detection Checklist for Your SOC

If you suspect a credential stuffing attack is hitting your environment, here's what to look for:

  • Spike in failed authentication attempts across many accounts from few IP sources
  • Successful logins from geographically impossible locations (velocity checks)
  • User agents associated with known credential stuffing tools
  • Unusual POST request volume against login or authentication API endpoints
  • Increased account lockouts or password reset requests
  • Customer complaints about unauthorized account activity

Correlate these signals in your SIEM. A single indicator might not be conclusive, but three or four together should trigger immediate investigation and response.

The Bottom Line: Credential Stuffing Is Preventable

Every credential stuffing attack I've investigated shared the same root causes — password reuse, missing MFA, and no credential screening. These aren't exotic problems. They're basic hygiene failures that persist because organizations underestimate how aggressively attackers exploit stolen credentials.

The tools exist. MFA, credential screening, bot mitigation, zero trust controls, and security awareness training — deployed together, they make credential stuffing attacks economically pointless for attackers. They'll move on to easier targets.

Start with MFA. Screen your passwords against breach databases. And invest in training your people to stop reusing passwords and recognize phishing attempts that steal credentials in the first place. The organizations that do these things don't end up in breach notification headlines. The ones that don't — well, ask 23andMe how that worked out.