You might have heard about data breaches in the news – where hackers get their hands on lists of usernames and passwords from various websites. But did you know those stolen credentials can be used in a sneaky attack called credential stuffing?

At Illinois State University, we want to make sure your digital "nest" is safe and sound! So, let's break down what credential stuffing is and how you can protect yourself.

What is Credential Stuffing?

Imagine a burglar trying to get into your house. They try the key they found for your shed, hoping it might also open your front door. If it does, they're in!

Credential stuffing works in a similar way online. When your username and password for one website are stolen in a data breach (like a big online store or social media site), cybercriminals take those stolen combinations and automatically try them on many other websites, including university systems. They're "stuffing" your old credentials into new login attempts, hoping you've reused them.

Why does this work? Because many of us, for convenience, use the same username and password for multiple online accounts. If criminals find a working combination from one site, they'll try it everywhere else, and sometimes, they get lucky!

How Does It Affect You?

If a credential stuffing attack is successful, criminals can gain unauthorized access to your accounts. This could mean:

• Access to your personal information: Like your email, social media, or even financial accounts if you use the same password.
• Identity theft: They could use your information to open new accounts or commit fraud.
• Compromise of university systems: If your ISU account is compromised, it could put university data at risk.

How to Protect Your Redbird Nest

The good news is that protecting yourself from credential stuffing is surprisingly simple!

1. Use Unique Passwords for Every Account: This is the most important step! If you use a different, strong password for every online account, a breach on one site won't affect your other accounts.

   • Pro Tip: Think of a unique and memorable passphrase instead of a single word password. For example, "RedbirdFlyHigh2025!" is much stronger than "Redbird123." 
   • Learn more about strong passwords here: https://help.illinoisstate.edu/informationsecurity/guidance/password-tips
     

2. Enable Multi-Factor Authentication (MFA) Wherever Possible: MFA adds an extra layer of security beyond just your password. Even if a criminal has your password, they'll still need a second verification step to get in (like a code sent to your phone or a touch of your fingerprint). Many ISU systems already use MFA, so make sure it's enabled on your personal accounts too!

3. Consider Using a Password Manager: These tools help you create and securely store unique, strong passwords for all your accounts, so you don't have to remember them all. They can even automatically fill in your login details for you.

4. Check if Your Accounts Have Been Compromised: Websites like "Have I Been Pwned?" (https://haveibeenpwned.com/) allow you to check if your email address or passwords have appeared in known data breaches. If they have, it's a strong indicator that you should change those passwords immediately.

5. Be Wary of Phishing Attempts: Credential stuffing often starts with information gathered from phishing attacks. Always be cautious of suspicious emails, messages, or websites that ask for your login information. If something feels off, don't click! Learn how to report phishing emails to ISU here: https://techsolutions.illinoisstate.edu/security/

By taking these simple steps, you can significantly reduce your risk of becoming a victim of credential stuffing and keep your digital nest secure!

If you have any questions or need further assistance, please contact the Information Security Office:

• Email: InformationSecurityOffice@IllinoisState.edu

Sources and Additional Resources:

• ISU Information Security Office: https://techsolutions.illinoisstate.edu/security/
• ISU Password Tips: https://help.illinoisstate.edu/informationsecurity/guidance/password-tips
• Illinois State University Policies and Procedures on Security: https://policy.illinoisstate.edu/technology/9-8-1/
• Have I Been Pwned?: https://haveibeenpwned.com/