Why this matters
If you’re running a business on email, this is worth a read.
Over the last few months, we’ve seen a sharp rise in a specific type of attack: credential stuffing. Attackers take lists of email addresses (often gathered from older data breaches or freely traded lists) and try common or reused passwords against each one. It’s not a sophisticated hack — it’s a numbers game. And because a business mailbox often holds invoices, contracts, customer data and logins, a single weak password can be all it takes.
How credential stuffing works
A bot receives a list of email addresses. For each address on the list, it tries a small set of common passwords, or passwords that leaked from other websites. If any one combination works, the attacker now has full access to that mailbox. Because the bot works through thousands of addresses at once, it only needs a small success rate to be profitable.
What brute-force looks like
Brute-force is the same idea aimed at one target. A bot tries passwords one after another until something works, or it rotates a long list of guesses. On a mail server, this appears as a flood of failed logins coming from many different IP addresses, sometimes over days.
The good news: both are preventable.
Practical steps to protect your mail
- Use a strong, unique password. At least 10 characters, a mix of upper and lower case, numbers and symbols. Most importantly, never reuse a password across accounts — a reused password is the number one reason credential stuffing works.
- Turn on two-factor authentication (2FA). Wherever your mail provider offers it, enable it. Even if a password is guessed, the attacker can’t get in without the second step.
- Lock out after failed attempts. On your mail server, set a failed-login threshold so a bot is blocked after a few wrong tries. This single control stops most of these attacks.
- Keep your computer clean. Malware such as keyloggers can silently steal passwords. Run a full scan regularly with reputable antivirus software.
- Be careful with links and attachments. No legitimate provider will ever ask for your password by email.
- Watch the logs. Monitor failed login attempts. A sudden spike is the warning sign.
What we do
As a mail hosting provider, we watch for these patterns, block offending IP addresses, and work with clients to harden their settings. But the most important step is on your side: a strong, unique password and a clean, well-protected device.
The bottom line
Credential stuffing and brute-force are preventable. With a strong password, lockout enabled, and a secure device, attackers are essentially guessing into a wall.