Credential stuffing
Credential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password. Cyber Essentials does not use the term, but its rules address it: staff should avoid passwords used elsewhere (A7.12), and MFA is required on all cloud services (A7.16, A7.17).
- Term
- Credential stuffing
- Also known as
- Password reuse attack, Credential replay
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term credential stuffing mean in Cyber Essentials?
Credential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
How does credential stuffing apply to Cyber Essentials?
In plain terms
Imagine a burglar finds your house key and then tries it on your office, your car and your shed. If you use one key for everything, one lost key opens it all. Online, the key is your email address and password. When a website you used years ago is breached, criminals feed that list into software that tries the same pairs on email, banking and business services.
What Cyber Essentials asks
The scheme tackles the causes rather than naming the attack.
- Unique passwords: the NCSC requirements say to educate people "about avoiding common passwords, such as a pet's name, common keyboard patterns or passwords they have used elsewhere", and to provide secure storage such as a password manager. A7.12 asks how you encourage unique and strong passwords.
- MFA: "authentication to cloud services must always use MFA". A reused password is not enough on its own when a second factor is needed. A No to A7.16 or A7.17 is an automatic fail.
- Brute-force limits: throttling or lockout slows automated login attempts (A7.10).
- A response process: A7.13 asks whether you have a process for when you believe passwords or accounts have been compromised. The requirements say passwords should be changed "promptly".
Practical points
A password manager makes a different password for every service realistic. If you hear that a service your staff use has been breached, treat it as a suspected compromise and follow your A7.13 process.
See MFA on cloud services and A7.13. Related: password manager, multi-factor authentication, brute-force attack.
Related terms
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
Frequently asked questions
Credential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
In the 2026 Danzell question set, credential stuffing comes up at A7.12, A7.13. Read those questions against the definition above so your answers use the term the way the assessor will.
Credential stuffing relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.