A credential-stuffing run converts 0.2% of pairs into logins — why is that profitable, and what kills it?

## Price the run, not the percentage A 0.2% hit rate sounds like failure to an engineer and reads as a healthy margin to the operator, because the two are measuring different things. The engineer is measuring success per attempt. The operator is measuring **cost per valid session**, and it drives that number down by attacking the denominator — the cost of an attempt — rather than the numerator. Break the cost structure apart: - **The corpus itself: effectively free.** Pairs from other organisations' breaches accumulate, get merged and deduplicated into combined lists numbering in the billions, and circulate at commodity prices or none. Nothing about this input depends on you. - **Address matching: free.** For a consumer login there is no targeting step at all; every address in the corpus is simply tried. - **Source diversity: rented.** Distributed residential source pools exist so that no per-source-address counter at the login accumulates. This is a metered cost and it is the largest line item in most runs. - **Challenge solving: metered per request.** Whatever interactive challenge sits in front of the login is priced as a per-solve fee by third parties who exist for that purpose. - **Compute and bandwidth: negligible** at these volumes. Against that, one million pairs at 0.2% is two thousand valid sessions. Whether the run clears depends only on whether two thousand sessions resell for more than a million metered requests cost — and the per-session resale value of an account with stored payment details, loyalty balance, or simply a reusable identity is far above the per-request price. That is why the run happens at all, and why the operator is entirely content with a rate that would embarrass an engineer. ## The corollary that trips people up Because the input costs nothing, **there is no volume at which the attack becomes uneconomic from your side**. You cannot exhaust the operator's patience or its corpus. Every request you make more expensive raises the price of the marginal run; it never removes the run, because the operator simply raises the price it charges the buyer of the sessions, or shifts to the next target where the same corpus works. ## Which levers touch which term | Change | Term it touches | Effect on the operator | |---|---|---| | Per-source-address throttling | cost per attempt | rents more source addresses; a line item, not a wall | | An interactive challenge at the login | cost per attempt | pays a per-solve fee; a line item | | Longer minimum password length | future hit rate | reduces recoverability from the *next* dump; slow-acting | | Screening at set time against a known-breached corpus | **hit rate now** | removes the intersection between the corpus and your estate | Only the last row changes the numerator. Screening at password-set time, plus a one-off screen of existing passwords with a forced change where they match, takes your accounts out of the corpus. A 0.2% hit rate is 0.2% *because that is the reuse overlap*; drive the overlap toward zero and the run against you returns nothing at any request price. ## Corpus value is not uniform The bulk arithmetic above describes commodity operators working a public consumer login. It is not the whole market, and the contrast is where the economics get interesting. A single reused pair belonging to one open-source maintainer — an address from a decade-old forum dump, matched by hand against a public profile, and a password never changed since — can be worth more than ten thousand consumer pairs. The bulk pairs monetise as interchangeable sessions at a low fixed unit price. The maintainer's pair monetises as reach: publish rights over a package, and thereby a path into every organisation that installs it. The corpus is the same corpus. What changes is that one operator sells volume and the other buys leverage, and the second only needs the reuse to hold **once**. That is why "our users are consumers, the pairs are low value" is a claim about your median account and says nothing about your worst one. ## The reviewer's answer Asked whether a 0.2% conversion means the attack is failing, the answer is: it means the attack is working as designed. The number to ask for is not the hit rate but the overlap — how many accounts in the estate currently hold a password that appears in a known-breached corpus. That number is measurable, it is the operator's actual yield, and screening is the only thing that reduces it.