The Have I Been Pwned database contains, as of 2024, over 13 billion records from more than 700 data breaches. Those records are a small fraction of what actually circulates in credential markets. The full ecosystem of stolen usernames and passwords - combolists compiled from hundreds of breaches, deduplicated and organized by domain, enriched with additional personal data, and sold or traded on Telegram channels and dark web forums - is one of the most active markets in cybercrime. Credential stuffing, the automated attack technique that uses this data, is responsible for the majority of unauthorized account accesses across every major online platform.
The economy this represents is both large and largely invisible to most people who are its victims. Every time an email address and password stolen from a lesser-known service is tried against Gmail, Netflix, banking portals, and cryptocurrency exchanges by automated tools running millions of login attempts per hour, someone's account is being tested for reuse. When the password matches - when the victim used the same password on the breached service as on their bank - the attacker has account access with no malware, no exploits, and no sophisticated techniques required. The breach at one service becomes the breach at every service.
The Credential Market Structure
Credential data flows through the criminal ecosystem in several distinct forms, each representing a different level of processing and a different market value.
Raw breach data is the largest category: databases dumped from breached services, typically containing email addresses, usernames, and hashed or plaintext passwords alongside whatever other data the service stored. Large breaches generate individual databases - the 2012 LinkedIn breach (117 million records), the 2013 Adobe breach (153 million), the 2013 Yahoo breach (3 billion). These raw dumps trade cheaply or are given away freely once they're old enough that the hashes have been cracked and the value has been extracted.
Combolists are the next stage: email:password or username:password pairs compiled from multiple breaches, deduplicated, and formatted for use in credential stuffing tools. A combolist might contain 50 million valid pairs drawn from 200 different breaches, representing years of aggregated theft. These circulate on Telegram channels dedicated to credential sharing, on dark web forums, and are also embedded in malware designed for ongoing credential collection. Collection 1, disclosed in January 2019, contained 773 million unique email addresses and over 21 million unique passwords - the largest combolist ever found at the time. It was assembled from thousands of smaller breaches.
Stealer logs represent a more current and higher-value category. Info-stealing malware (Lumma, Redline, Vidar, Raccoon, and dozens of similar families) runs on victim machines and captures credentials directly from browsers as users type them or as browsers autofill them. Unlike database dumps that might contain credentials from years ago, stealer logs contain credentials that were active at the moment of capture - valid sessions, fresh passwords, recently changed credentials that wouldn't appear in any breach database. Stealer logs trade at significant premiums: a log containing active session cookies for banking services might sell for hundreds of dollars on markets like 2easy or Russian Market.
Credential Stuffing: The Automation Layer
Credential stuffing tools automate the process of testing stolen credentials against target services. Tools like Sentry MBA, STORM, Openbullet, and Silverbullet accept combolists as input and a "config" defining how to interact with a specific website's login flow - where to submit the username and password, what response indicates success, how to handle CAPTCHAs, how to rotate through proxy IP addresses to avoid rate limiting. Configs for major services are shared freely in the same Telegram channels and forums where combolists circulate.
A competent credential stuffing operation can test millions of credential pairs per day across multiple services. The hit rate - the percentage of tested credentials that result in a successful login - varies enormously by service and combolist quality. Against a major email provider with an old combolist, the hit rate might be below 0.1%. Against a service whose specific breach data is in the list, it might be 5-20%. Even at 0.1%, testing 10 million credentials produces 10,000 successful logins.
The most significant limitation on credential stuffing operations is IP reputation and rate limiting. Major services maintain large-scale bot detection systems that flag unusual login patterns - too many failed attempts from a single IP, login attempts from IPs with no prior relationship to the account, impossible geography (login from an IP in Russia immediately after a login from the UK). Credential stuffers work around this through proxy networks: residential proxy services that route traffic through IP addresses associated with genuine consumer internet connections provide cover. Major residential proxy networks advertise millions of IP addresses available for rotation.
Password Reuse: The Root Cause
Credential stuffing works because a large percentage of people reuse passwords across multiple services. Survey data and breach analysis consistently finds that 50-65% of people reuse passwords either exactly or with minor variations. This is not irrational behavior given the cognitive burden of managing dozens of distinct secure passwords - it is a reasonable response to an unreasonable demand. The average person has accounts at 70-100 services. Remembering 70-100 distinct random passwords is not cognitively feasible without external tools.
The problem is structural: the security model of username/password authentication requires that each credential pair be both memorable and unique. These requirements are in direct tension. Systems that try to enforce memorability (limiting password complexity or length) reduce uniqueness. Systems that enforce uniqueness and complexity (requiring random high-entropy passwords) destroy memorability. Password managers address this by moving the memorability requirement to a single master credential, but adoption remains low - surveys suggest 20-35% of people use password managers, leaving the majority creating and reusing memorable passwords.
The secondary factor is that people use predictable variations when they do attempt password differentiation. "Netflix2023!" and "Facebook2023!" are not the same password, but they're not genuinely different passwords either - an attacker who knows one can guess the other with a simple mutation rule. Credential stuffing tools include mutation logic for exactly this pattern: substituting common words associated with the target service, appending years or numbers, capitalizing differently.
The Breach Ecosystem Feeding the Market
The credential market requires a continuous supply of fresh breach data. This supply comes from several sources operating continuously.
Major database breaches of large services generate one-time but significant volumes. The 2012-2013 wave of breaches against LinkedIn, Dropbox, Adobe, Myspace, Tumblr, and others produced credential databases that were still being circulated and cracked years after the original incidents, because the services had not detected the breaches immediately and the scope had been dramatically underestimated in initial disclosures. LinkedIn's 2012 breach, initially disclosed as 6.5 million records, was later found to involve 117 million records when the full database surfaced for sale in 2016.
Info-stealing malware campaigns provide a continuous drip of fresh credentials from infected consumer and enterprise machines. The major stealer families (Lumma, Redline, Vidar, Raccoon, Rhadamanthys, and their successors) are distributed through malvertising, cracked software, YouTube tutorial videos with malicious links, and compromised websites. An infected machine typically yields hundreds or thousands of credentials captured from browser password managers and active sessions. The aggregated output of major stealer campaigns is enormous: the total number of credentials harvested by info-stealers globally is estimated in the billions annually.
Phishing campaigns targeting specific services create smaller but higher-quality credential sets. A targeted phishing campaign against the users of a specific bank or cryptocurrency exchange produces credentials that are current, confirmed as valid (the victim just typed them), and specific to the target service. These tend to be used immediately rather than circulated, as their value decays quickly.
Defenses: What Works and What Doesn't
Multi-factor authentication is the single most effective defense against credential stuffing. If a successful password match doesn't produce account access without a second factor, the stolen credential is useless for unauthorized access. This is why MFA adoption rates are a meaningful metric for the overall security of the credential ecosystem - high MFA adoption degrades the value of combolist data substantially.
The limitation is that MFA is not universal. Many services do not offer it; many users do not enable it when it is available; some MFA implementations (SMS-based OTP) can be bypassed through SIM swapping or SS7 attacks. The strongest forms of MFA - FIDO2 hardware keys, passkeys - are phishing-resistant and credential-stuffing-resistant by design, but adoption remains concentrated in technical users.
For the services being stuffed rather than the users whose credentials are being stuffed, the primary defense is bot detection and rate limiting. IP reputation services, device fingerprinting, behavioral analysis, and CAPTCHA collectively make credential stuffing more expensive by requiring more sophisticated infrastructure to work around each layer. Major services invest significantly in this layer: Google, Microsoft, and major financial institutions maintain large-scale bot detection infrastructure that makes stuffing against them substantially more difficult and expensive than against smaller services.
Password breach alerting - services that check submitted passwords against known breach databases before accepting them - helps prevent the creation of new accounts with compromised passwords. Firefox Monitor, Google Password Checkup, and similar tools alert users when their credentials appear in known breaches. Have I Been Pwned's "Pwned Passwords" API, which allows services to check passwords against 850+ million compromised passwords without revealing the full password, has been integrated into a large number of platforms and password managers.
The fundamental defense, however, is unique passwords per service managed by a password manager, combined with MFA. Everything else is treating the symptom rather than the cause. The credential stuffing ecosystem exists because passwords are reused; the solution is to stop reusing them. The barrier is not technical - password managers work, are available for free, and are supported across all platforms - it is behavioral. Moving 50% of internet users from password reuse to password managers would substantially degrade the economics of credential stuffing. That behavioral change has been the goal of industry campaigns for a decade and remains only partially achieved.