This page gives you an overview of our breached credential database.
On this page:Breached credentials are used by fraudsters when committing credential stuffing attacks. Attackers get credential combinations (usernames and passwords) from data breaches. Fraudsters can then automatically try all these combinations against your login page to see if there are any matches.
Breached credentials pose a significant risk at the point of account registration. Allowing users to create accounts with breached credentials increases the risk the account will be compromised in a future ATO attack.
You can read more about how fraudsters use breached credentials in our Ravelin Insights Guide.
Ravelin maintains a breached credentials database containing over 5 billion leaked credentials. Ravelin sources credentials from cracking forums, the dark web, and via weekly updates from our third-party providers. The database also includes commonly used passwords that are considered breached.
Any credentials that appear in our database should be considered very risky as they are widely available for attackers to use.
We check whether usernames and passwords are in our database when you send a request to our Registration endpoint.
The response will contain a credentialStatus field which indicates whether the credentials
are in our database.
If the credentials were breached, we will return a response similar to the one shown below:
{
"credentialStatus": {
"passwordBreached": true,
"usernameBreached": true,
}
}
This response shows that the given username and password were breached.
If the passwordBreached field is true then the credentials have been breached and you should follow our advice below.
If a customer does provide breached credentials in an account registration attempt, we recommend allowing the customer to create the account to avoid negatively impacting conversion. However, we strongly recommend prompting them to change the password. For example, by:
You should advise customers not to reuse passwords when creating a new account on your service.
Was this page helpful?