The post 15 Costliest Credential Stuffing Attack Examples of the Decade (and the Authentication Lessons They Teach) appeared first on MojoAuth Blog – Passwordless Authentication & Identity Solutions.
Credential stuffing attacks have drained billions from businesses, triggered regulatory fines, and exposed hundreds of millions of users over the past ten years. They work because people reuse passwords, and because most login systems are still built to accept a username and password and ask no further questions. This article breaks down the 15 most damaging credential stuffing incidents since 2015, turns each one into a concrete lesson, and shows exactly where passwordless authentication would have changed the outcome.
Key Takeaways
- Credential stuffing exploits password reuse, not software vulnerabilities. The attack is cheap to run, hard to detect, and devastating at scale.
- Every incident below was enabled by one root cause: passwords that had already been exposed in a prior breach.
- Passwordless authentication (passkeys, hardware tokens, biometric-bound credentials) makes credential stuffing structurally impossible because there is no password to stuff.
- Regulators are now treating failure to defend against credential stuffing as negligence, not bad luck. Fines are growing.
- The pattern across all 15 cases is identical. Stop the pattern, and you stop the breach.
What Is a Credential Stuffing Attack, and Why Does It Keep Working?
Credential stuffing is automated account takeover. Attackers buy or download lists of username-and-password pairs leaked in previous breaches, then fire them at a new target using bots that can test thousands of combinations per minute. If a user reused their password, the bot logs in. Simple. Scalable. Alarmingly effective.
The success rate for credential stuffing is typically 0.1% to 2%. That sounds low until you realize attackers are working from lists of 100 million credentials. Even a 0.1% hit rate returns 100,000 compromised accounts. Those accounts get sold, drained, or used for fraud within hours.
What keeps this working in 2025 is not sophisticated malware or nation-state tradecraft. It's the password itself. As long as users reuse passwords and companies keep accepting them as proof of identity, credential stuffing will keep producing results.
The 15 Worst Credential Stuffing Attack Examples of the Decade
1. Snowflake (2024): 165 Organizations Hit Through One Shared Weakness
In 2024, attackers used credentials stolen from information-stealing malware to access customer accounts on the Snowflake cloud data platform. Because Snowflake accounts in these cases lacked multi-factor authentication, valid usernames and passwords were all that was needed. More than 165 customer organizations were affected, including Ticketmaster, Santander, and AT&T. The attackers did not breach Snowflake's infrastructure. They walked in through the front door using credentials that worked.
The scale of downstream exposure was enormous. Ticketmaster alone saw 560 million records claimed by the attackers. Santander reported data on tens of millions of customers.
2. 23andMe (2023): 6.9 Million Users and a Regulatory Fine That Set a Precedent
In October 2023, 23andMe confirmed that attackers used credential stuffing to access around 14,000 accounts. That sounds contained until you factor in the DNA Relatives feature. Because compromised accounts were opted into data sharing, the attackers were able to harvest profile data on roughly 6.9 million users from those initial 14,000 entry points. The exposed data included ancestry details, ethnicity estimates, and in some cases health-related genetic information.
The UK Information Commissioner's Office fined 23andMe £2.31 million in 2025 for failing to implement adequate protections against credential stuffing, including MFA. The ICO ruling was explicit: this was a foreseeable, preventable attack, and the company had not done enough to stop it.
3. Ticketmaster and Live Nation (2024): Supply Chain Credential Exposure
Ticketmaster's data was exposed as part of the broader Snowflake supply chain compromise described above, but the incident deserves its own entry because of the downstream consequences. A threat actor group called ShinyHunters claimed responsibility for exfiltrating 1.3 terabytes of data, including 560 million customer records covering names, addresses, phone numbers, and partial payment data.
4. Disney+ Launch Day (2019): Account Takeover Within Hours of Launch
When Disney+ launched in November 2019, thousands of accounts were taken over within hours of the service going live. Cybersecurity researchers found compromised credentials being sold on dark-web marketplaces for as little as $3 to $11 per account. Disney confirmed no breach of its own systems. The attackers used credentials from other breaches to log in to newly created Disney+ accounts where users had, predictably, reused their passwords.
5. Norton LifeLock (2023): 6,450 Accounts Breached at an Identity Protection Company
In January 2023, Norton LifeLock disclosed that attackers had used credential stuffing to access approximately 6,450 customer accounts. The attack started with a list of username-and-password pairs obtained from other sources. Attackers tried them against Norton's login portal, and a significant number worked.
6. Dunkin' Donuts and the FTC Settlement (2015-2019)
Dunkin' experienced multiple credential stuffing campaigns against its DD Perks loyalty program between 2015 and 2019. Attackers used automated tools to log in to accounts, drain stored value, and sell working credentials on underground markets.
7. PayPal (2022): Nearly 35,000 Accounts Hit Over Two Days
In December 2022, PayPal disclosed that credential stuffing attacks had compromised nearly 35,000 accounts between December 6 and December 8. Exposed data included full names, dates of birth, postal addresses, Social Security numbers, and individual tax ID numbers.
8. Amtrak Guest Rewards (2020): Loyalty Points and Personal Data at Risk
Amtrak notified customers in May 2020 that their Guest Rewards accounts had been accessed by unauthorized third parties.
9. The North Face (2022): Retail Accounts Targeted for Stored Value
The North Face disclosed in August 2022 that a credential stuffing attack between July 26 and August 19 had accessed customer accounts on its website.
10. Okta Support Unit Compromise (2023): When the Identity Provider Gets Hit
In October 2023, Okta disclosed that attackers had gained access to its customer support case management system using stolen credentials.
11. DraftKings (2022): Sports Betting Accounts Drained Within Hours
In November 2022, DraftKings CEO Jason Robins confirmed that approximately $300,000 had been drained from customer accounts following a credential stuffing attack.
12. Roku (2024): 576,000 Accounts Taken Over Across Two Incidents
Roku disclosed two separate credential stuffing incidents in 2024.
13. Internet Archive (2024): A Cultural Institution Hit by Credential Attacks
In October 2024, the Internet Archive confirmed it had been hit by multiple security incidents including a data breach affecting 31 million user records and a separate credential stuffing campaign against its Zendesk-based support system.
14. Finastra and Banking Supply Chain Compromises (2024)
Finastra, a financial technology company serving over 8,000 financial institutions, disclosed in November 2024 that it had identified suspicious activity on its Secure File Transfer Platform.
15. 23andMe Genetic Data Exposure: The "Un-Breachable" Category
Genetic data platforms have an especially strong argument for making passwordless authentication the default, not an optional setting. An account holding permanent, irreversible personal data should not be accessible to a bot running a credential list.
Why the Same Attack Has Worked 15 Times in a Row
The security community has known this for years. Multi-factor authentication helps, and it has reduced the success rate of credential stuffing considerably for organizations that enforce it. But MFA is not the final answer. SMS-based MFA can be bypassed through SIM swapping.
What Passwordless Authentication Actually Means for Account Takeover Prevention
Passwordless authentication using FIDO2 passkeys or hardware security keys works differently from everything attackers have learned to exploit.
Frequently Asked Questions
What Is the Difference Between Credential Stuffing and a Data Breach?
A data breach is when attackers extract data directly from a company's systems, often through vulnerabilities.
Can Multi-Factor Authentication Stop Credential Stuffing?
MFA significantly reduces the success rate of credential stuffing, but it does not eliminate it.
How Do Attackers Get the Credential Lists They Use?
Credential lists come from prior data breaches that have been sold or posted on underground markets.
What Should a CISO Do Right Now to Reduce Credential Stuffing Risk?
The highest-impact steps in order of priority are: enforce phishing-resistant MFA, implement rate limiting and bot detection on all login endpoints.
Are Passwordless Solutions Ready for Enterprise Deployment?
Yes. Passkey support is built into major platforms. The technical infrastructure is mature.
What Is the Largest Credential Stuffing Attack Ever Recorded?
By affected user count, the 23andMe breach and the Roku incidents represent significant scale.
Final Thoughts
The good news is that the fix is deployable today. Passkeys are not a future technology or an emerging standard. They are shipping in consumer devices and enterprise identity platforms right now. If you want to take the first step toward making credential stuffing structurally impossible for your organization, download the Credential Stuffing Survival Guide to see Zero-Store passwordless authentication in action.