FixableProtecting your accounts
Credential stuffing
Stolen password lists tried automatically against your logins.
Understand it
Attackers take username-and-password lists leaked elsewhere and fire them, by the million, at other sites, wagering that people reuse. If your password leaked anywhere, it is being tried everywhere.
How to spot it
Bursts of failed logins, lockouts, or sign-ins from places you do not recognise.
Close the gap
- Never reuse passwords - this attack only works when you do.
- Turn on two-step sign-in to defeat stuffed passwords.
- On your own sites, add rate-limiting and a breached-password check.
- Alert on login spikes and on new-device sign-ins.
What to do about it
This is part of your plan - Turn on two-step sign-in where it matters. Work through it there and you’ll close this off along with everything else it covers.