Credential stuffing
Automated attack that bulk-tests credential pairs from prior data breaches to take over new accounts.
In October 2023, 23andMe disclosed an attack built on reused passwords. The company later put the accounts accessed by credential stuffing at about 14,000, and the people whose profiles leaked through the DNA Relatives feature at 6.9 million. Credential stuffing exploits password reuse: most users keep the same credentials from one service to the next. The attacker buys or downloads lists of login/password pairs from past breaches on underground forums. Then he scripts log-in attempts against high-value targets such as banks, e-commerce platforms or online insurers. The success rate is low, often below one percent, but one million attempts still yields thousands of compromised accounts. Standard defenses are CAPTCHAs, rate limiting and multi-factor authentication. For insurers, credential stuffing often leads to fraud on customer portals and to data breach notification duties. That is why cyber underwriting questionnaires ask about it as standard. It differs from brute force, which generates random passwords, and from phishing, which targets a specific individual: it relies solely on already-compromised data.
Textbook case: a life insurer discovers in an audit that thousands of logins to its customer portal originate from South American bots. Credential stuffing granted access to 340 accounts, some of which suffered changes to banking details. GDPR notification is triggered and the cyber policy renewal premium rises by 15%.
- 23andMe, SEC filing, December 2023, as reported by NBC News ("23andMe says hackers gained access to data of about 6.9 million people") and HIPAA Journal
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.