In a report released Wednesday, the New York State Attorney General (AOG) details an investigation into credential stuffing attacks. These attacks involve the hacker using a set number of passwords compiled into a list which they use to attempt to log into multiple accounts at once. Once an account is breached, it is sold on dark web forums for various amounts of money. The AOG surveilled multiple online communities dedicated to the resale of these accounts and harvested over 1.1 million customer accounts. Following the collection of this data, the AOG identified seventeen (17) “well-known” companies who did not have adequate protection against credential stuffing attacks and appeared in the investigation. In the report, the AOG identified numerous ways to protect against these attacks, including safeguards to prevent the attacks, detecting malicious activity after these attacks are preformed, and preventing the stolen accounts from being used for fraud. Credential stuffing attacks are a growing issue faced by many online businesses. With an estimated 15 billion stolen credentials in circulation today, investigations into this attack surface are much needed and the information the AOG provided will surely stop many attacks in the future.