# Credential Stuffing After a Breach: What to Do in the First 24 Hours

Source: https://botbulwark.com/blog/2026-11-10-credential-stuffing-first-24-hours.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** Credential stuffing starts within hours of a breach, and the first day decides how many accounts fall. Lock the testing out with velocity limits and bot challenges, force resets on the accounts that were hit, and watch the login logs, not the headlines. The breach you read about is already being tested against your login page.

## The testing starts before the announcement

A single leaked database from a mid-tier retail breach in early 2026 contained 4.3 billion username-password pairs, and within 72 hours automated bots had tested a statistically significant portion of those credentials against banking portals, SaaS platforms, and healthcare patient portals across North America and Europe. The testing does not wait for the press release. It starts when the database hits the market, and the market moves in hours. By the time your team reads the breach notice, the bots have already run the first pass against your login page.

The scale is the reason the first day matters. There are over 24 billion stolen credential pairs circulating in underground databases, and attackers test them at a rate of 26 billion attempts per month globally. Akamai's network measurement puts credential stuffing at 193 billion attempts per year, up 47 percent year over year in 2025. A single list of 500 million records, tested at a success rate as low as 0.1 percent, still yields 500,000 validated accounts. [Bad bots are now 40 percent of web traffic](https://botbulwark.com/blog/2026-11-09-bad-bots-40-percent-web-traffic-2026.md), and login pages are where the largest share of that traffic goes.

## Why the login page is the target

Login is the most active stage of the account lifecycle and a major entry point for malicious bot activity. Akamai's State of the Internet report for 2026 found that account verification requests made up 40 percent of high and critical risk login traffic, suggesting attackers validate legitimate accounts before launching credential stuffing or other abuse. The pattern is reconnaissance first: check whether the email address is linked to a valid account, then test the password list against the accounts that exist. Standard login attempts made up 36.2 percent of high-risk login activity, and payment activity 12.6 percent. The login page is where the attacker learns what to attack next.

The reason stuffing works is password reuse. SpyCloud's 2025 Identity Exposure Report puts reuse at 65 percent of users across platforms, so a password stolen from a breached retailer works on a bank, a SaaS app, and an email account more often than not. Verizon's 2025 Data Breach Investigations Report found compromised credentials were the initial access vector in 22 percent of all confirmed breaches, the highest of any attack method, ahead of phishing and exploitation. In enterprise environments, 19 percent of all authentication attempts on any given day are credential stuffing attacks, not legitimate users. [Your analytics and your ad reports disagree about bot traffic](https://botbulwark.com/blog/2026-11-09-givt-vs-sivt-analytics-disagree.md) for the same reason your login logs do: the bots look like users until you count them.

## The first 24 hours, in order

First, turn on the velocity limits and the bot challenge on the login and password-reset endpoints, before you do anything else. The attack needs thousands of attempts a minute and a real user needs three, so a per-IP and per-account limit with a short lockout stops the run cold. Second, check the logs for the shape of the attack: a spike in failed logins from many IPs, a cluster of account verification requests, and logins from impossible travel. Akamai documented two simultaneous attacks against one APAC financial institution in July 2026: one generated 42,000 requests over seven days, the other just 164, and both were aimed at the same systems within hours of each other. The quiet one is the dangerous one.

Third, force password resets on the accounts that were hit, not on everyone. A blanket reset punishes your real users and teaches them to ignore the next one. Fourth, turn on MFA enrollment prompts for the hit accounts and for high-value accounts generally, because a password alone is the vulnerability being exploited. Fifth, tell the support team what the attack looks like, so the first customer who calls about a locked account gets help instead of a lecture. [Good bots and bad bots are not the same problem](https://botbulwark.com/blog/2026-11-08-good-bots-vs-bad-bots-crawlers.md), and the login page is where the distinction matters most: search crawlers never log in.

## What not to do

Do not wait for the breach announcement to act. Do not block IP ranges by hand while the attack is running, because residential proxies make the list obsolete before you finish writing it. Do not email every user telling them to change their password, because the reset email becomes a phishing lure the same day. And do not treat the attack as over when the volume drops. The first pass validates the accounts. The second pass, days later, is the account takeover, and it uses the validated list quietly, a few logins at a time, from IPs that have never been flagged. The defense that works is the one that stays on after the spike: velocity limits, bot management in blocking mode, and MFA on the accounts that matter.

## Frequently asked questions

### How fast does credential stuffing start after a breach?

Within hours. A 4.3 billion pair database from early 2026 was tested against banking, SaaS, and healthcare portals within 72 hours. The testing starts when the database hits the market, not when the breach is announced.

### What is the difference between credential stuffing and brute force?

Brute force guesses passwords. Credential stuffing tests known, valid username-password pairs harvested from prior breaches against different services, exploiting the fact that 65 percent of users reuse passwords across platforms.

### Why do attackers send account verification requests first?

To check whether an email address is linked to a valid account before launching the stuffing run. Akamai found verification requests made up 40 percent of high and critical risk login traffic, the largest single category.

### Does MFA stop credential stuffing?

It stops the takeover, not the testing. The bots will still try the passwords, but a valid password alone no longer opens the account. Pair MFA with velocity limits and bot challenges so the testing itself gets expensive.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)