---
schema_version: "1"
id: dda2a1b50ddd71ea3425c48797c8ee432d98f50f3ad09e463bf04a0a857ba911
title: Credential Stuffing
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_credstuff.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_credstuff.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9c32b548035e42103ad7469b05aaeb151ba4894251de8552f2d8a566784288a8
description: Credential stuffing is a type of cyber attack that uses stolen account credentials. It’s also known as “password spraying” or “credential spills”. Attackers obtain large numbers of usernames and passwords through data breaches or other types of cyber attacks. They then use these credentials to gain unauthorized access to user accounts through large-scale automated login requests against a web application such as Salesforce.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Credential Stuffing

Credential stuffing is a type of cyber attack that uses stolen account credentials. It’s also known as “password spraying” or “credential spills”. Attackers obtain large numbers of usernames and passwords through data breaches or other types of cyber attacks. They then use these credentials to gain unauthorized access to user accounts through large-scale automated login requests against a web application such as Salesforce.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

Salesforce identifies a credential stuffing attack using a two-step process. First, it detects if a credential stuffing attack is taking place by analyzing the login traffic. In particular, we look for attackers who stuff multiple credentials in the same end-point or stuff the same user accounts by enumerating multiple passwords. Next we check the ratio of successful versus failed login traffic volume. If the volume exceeds a certain threshold, we use more fingerprint details to identify the affected user’s profile.

When we detect a successful login from an endpoint that exhibits credential stuffing behavior, we pose an identity challenge to the affected user. If the user successfully completes that challenge, they are required to change their password before accessing Salesforce again.

All Salesforce customers get this threat mitigation. However, Event Monitoring customers can get granular visibility into these attacks using the CredentialStuffingEvent object. These customers can then collect useful information related to these events in real time and send notifications to other users in Salesforce.

- **[Investigate Credential Stuffing](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_credstuff_review.htm&release=264.0.0&type=5)**  
    Here are some tips for investigating a credential stuffing attack.