The reality of breaches is the amount ofinformation available on the dark web. In 2016, hackers stole somethree billion credentials, some of which they use in accounttakeovers.

The big security threat called credential stuffing is the use ofautomated means to test stolen logins/passwords en masse againstother websites. The practice isn't new, but new sophisticatedinstruments are helping to fuel its growth.

A recent study from Mountain View, Calif. Shape Security, “2017Credential Spill Report,” showed stuffing attacks resulted in $1billion in attempted fraud in 2016 alone. In addition,credential-stuffing login attempts account for 90% of all logins inweb and mobile applications. Hackers achieve a success rate of 0.1to 2% when reusing stolen credentials to access other sites,according to Shape Security.