TL;DR:

  • Credential stuffing isn’t hacking — it’s automated login attempts using real username and password combinations leaked from other breaches. Attackers buy these lists and try them against your login pages at scale
  • UK small businesses are targeted because they often lack the login protections that large enterprises have: no MFA, no rate limiting, no anomaly detection
  • The primary defence is multi-factor authentication — it makes a stolen password nearly useless. Secondary defences are rate limiting and monitoring for unusual login activity

If your email address and password were exposed in a breach at a retailer, a forum, or any of the hundreds of databases that have leaked over the past decade, someone has already tried them against your business email, your accounting software, and your bank portal. This is credential stuffing. It’s automated, it’s cheap to run, and it works precisely because people reuse passwords across accounts.

What Credential Stuffing Is

When a service is breached, the stolen database often contains email addresses and hashed (or in the worst cases, plaintext) passwords. These databases are sold on dark web marketplaces and forums, aggregated into large collections (COMB — Compilation of Many Breaches — contained 3.2 billion records when first circulated), and used by credential stuffing toolkits.

The toolkit — OpenBullet, SentryMBA, and similar tools — accepts a list of email:password combinations and a target website, then makes automated login attempts at rate-controlled speed to avoid triggering rate limits. Successful logins are flagged for the attacker to review.

This is different from brute force. Brute force tries random passwords. Credential stuffing tries real passwords that real people chose for other services. The success rate is low (often 0.1–2%) but at the scale of millions of pairs, that still yields thousands of compromised accounts.

Why Small Businesses Are Targeted

Large businesses tend to have protections that credential stuffing tools are designed to work around — but those protections take resources to implement:

  • No MFA on business accounts — a small business with Xero, QuickBooks, or Sage login protected only by a password is vulnerable to any working credential pair from a breach list
  • No rate limiting on login pages — if your website or customer portal allows unlimited login attempts without slowdown or lockout, stuffing tools will work through millions of attempts unimpeded
  • Shared passwords across accounts — small business owners and staff frequently reuse passwords. A breach at one service becomes an entry point for multiple systems
  • High-value targets for low effort — access to a business’s accounting software, email, or payment portal has immediate value for fraud and BEC (business email compromise) attacks

What Attackers Do With Access

Business email compromise. Access to a business owner’s or finance manager’s email enables invoice fraud, redirection of payments to attacker-controlled accounts, and impersonation of the business to suppliers or customers. UK Finance reported £460 million in BEC-related losses in 2025.

Accounting software access. Xero, QuickBooks, and Sage access lets an attacker view financial data, redirect supplier bank details, or submit fraudulent invoices. Some attacks change payroll details before triggering a legitimate payroll run.

Online retail and payment accounts. Access to your Shopify, WooCommerce admin, or PayPal business account enables refund fraud, inventory theft, or direct financial transfer.

Resale. Not all credential stuffing is targeted at your specific business. Validated working credentials are resold as a service — “logs” — to other criminals who then decide how to exploit them.

Check Your Exposure

Have I Been Pwned (haveibeenpwned.com) — Troy Hunt’s service indexes known breach databases. Enter an email address to see which breaches it appears in. You can also set up notifications for your domain, which alerts you whenever any email address at your domain appears in a new breach.

Firefox Monitor / Google One Dark Web Report — similar services that check your email against breach databases and provide ongoing monitoring.

If your email appears in breaches, assume any password you’ve used at that email address is compromised. Change it on any service where you still use it, and check whether those accounts show unexpected activity.

What Actually Stops Credential Stuffing

Multi-factor authentication (MFA) is by far the most effective defence. With MFA enabled, a stolen password is not enough — the attacker also needs the second factor (authenticator app code, SMS, hardware key). Credential stuffing tools cannot provide the second factor, so they move on.

Enable MFA on everything business-critical:

  • Email (Microsoft 365 / Google Workspace)
  • Accounting software (Xero, QuickBooks, Sage — all support it)
  • Banking and payment accounts
  • Cloud services (AWS, Azure, GCP)
  • Domain registrar and DNS provider
  • Your website admin panel (WordPress, Shopify, etc.)

Use an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) rather than SMS where possible. SMS codes can be intercepted via SIM swapping, which is less likely than losing a password but still a real attack vector.

Password managers address the root cause. When every service has a unique, randomly generated password, a breach at one service doesn’t compromise any other. Bitwarden (free and open source), 1Password, and Dashlane all have business plans for team use, with admin controls for onboarding and offboarding staff.

Rate limiting and account lockout reduce the volume of attempts an attacker can make. If you operate any customer-facing login page, your developer or hosting provider should implement:

  • Temporary lockout after 5–10 failed attempts
  • CAPTCHA or browser challenge after repeated failures from the same IP
  • Rate limiting per IP address

Login monitoring and alerting. Microsoft 365 and Google Workspace both have sign-in logs with location and device data. Review them periodically, or set up alerts for logins from unusual countries or at unusual hours. A login from Romania at 3am on a Sunday should trigger a password change and review.

If an Account Is Compromised

  1. Change the password immediately on the compromised account, and on any other service where you used the same password
  2. Revoke all active sessions — both Microsoft 365 and Google Workspace have a “sign out everywhere” option in security settings
  3. Enable MFA if it wasn’t already on
  4. Review recent activity — check sent emails for anything you didn’t send, check financial accounts for transactions you don’t recognise, check accounting software for any changes to bank details or supplier records
  5. Notify affected parties if business emails were compromised — customers or suppliers may have received fraudulent emails purporting to be from you
  6. Report to Action Fraud (0300 123 2040 or actionfraud.police.uk) if financial loss occurred

Quick Wins for Small Businesses

If you do nothing else this week, do these three things:

  1. Turn on MFA for your business email — it takes 5 minutes and is the single highest-impact security action available
  2. Check your business email addresses at haveibeenpwned.com and set up domain monitoring
  3. If you’re sharing passwords across services, pick a password manager and start generating unique passwords for critical accounts

References