Akamai: there were 55B credential stuffing attacks between Nov. '17 and March '19; US was the top source and target, with 67% of attacks targeting US-based orgs
Hackers have targeted the gaming industry by carrying out 12 billion credential stuffing attacks against gaming websites …
Context & Ripple Effects
This report is Akamai scaling up its own telemetry work: months earlier it had found that 43% of 17 billion login requests crossing its platform involved credential abuse (bots replaying stolen logins). Now it has quantified the phenomenon across seventeen months — 55 billion credential stuffing attempts, with gaming alone absorbing 12 billion.
The gaming concentration proved durable rather than episodic: Akamai later reported web application attacks on the sector up 167% year over year (gaming attacks climbing through 2022), while the raw material keeps compounding — Flashpoint counted 3.2 billion credentials stolen from organizations in 2024 (theft volumes still rising) — meaning every new breach enlarges the ammunition pool for exactly this attack class.
First-order effects
- Gaming operators bearing 12 billion of these attempts face direct account-takeover fraud on accounts that hold payment cards and virtual goods, forcing spend on bot detection and rate limiting at the login layer right now.
- With 67% of attacks aimed at US-based organizations, American security teams are the immediate buyers for the bot-management capacity Akamai's findings implicitly sell.
Second-order effects
- Akamai's platform telemetry functions as sales collateral — each report converts measured attack volume into demand for its mitigation products, pressuring rival edge vendors to publish comparable threat data to stay credible.
- Because one breached site's credential dump fuels attacks against many unrelated sites, even unbreached gaming and e-commerce operators are pushed into multi-factor authentication and anomaly detection defensively.
Third-order effects
- If stolen-credential supply keeps growing as the later Flashpoint figures indicate, password-only authentication becomes structurally untenable at scale, accelerating an industry-wide shift toward MFA and phishing-resistant credentials.
- Attack economics that favor cheap automation over bespoke intrusion make credential-stuffing defense a baseline operating requirement for consumer-facing platforms rather than optional hardening.
The trend: Automated account takeover powered by recycled breach credentials is scaling into a permanent industry, with gaming and US-based organizations as its center of gravity.