If you received an email from Groupon this week telling you your password had been reset — not because Groupon was breached, but because your credentials appeared in a leak from somewhere else — you have just had a front-row seat to one of the most common attacks hitting NZ businesses right now.
That email is a near-perfect explanation of credential stuffing. And the reason it matters for your business has nothing to do with Groupon.
What the Email Actually Says
The Groupon notification is worth reading carefully because it describes the attack more clearly than most security advisories:
*"Due to a data breach at another company, we believe that your Groupon account credentials may have been included in a recent release of email addresses and passwords. To clarify, there has been no data breach at Groupon. However, if you use the same account credentials for Groupon that you use for other companies, fraudsters who have obtained those details from another company could use them to log into your Groupon account."*
Three sentences. Three things to understand:
- The breach happened somewhere else entirely — possibly years ago
- Groupon itself was not compromised
- The attacker does not need to hack Groupon at all if they already have the password
This is credential stuffing. The attacker takes a database of leaked username/password pairs — bought on a criminal marketplace for almost nothing — and automatically tries them against hundreds of other services. Most fail. Some succeed. When they succeed against a banking app, a payroll system, or a corporate Microsoft 365 account, the attacker is in.
Why Your Business Is the Real Target
Groupon is a low-stakes example. Your staff are logging into far more consequential systems with the same passwords they use for their personal accounts.
Think about what a successful credential stuffing attack against one of your employees actually means:
- Email access means access to password reset flows for everything else
- Microsoft 365 or Google Workspace access means access to shared drives, financial documents, client records
- Payroll system access means the ability to redirect salary payments
- CRM access means the ability to steal your client list or plant ransomware
None of these require the attacker to "hack" your systems. They just need a password that works. And the average employee reuses their main password across 14 different accounts, according to security research consistently cited by CERT NZ.
The Scale of the Problem in New Zealand
CERT NZ receives reports of credential stuffing attacks regularly, and the volume has increased year-on-year as the total number of leaked credential databases has grown. Repositories like Have I Been Pwned now list over 13 billion compromised accounts. The databases used in attacks are not obscure — they are collated, de-duplicated, and sold in bulk.
What makes credential stuffing particularly dangerous for NZ SMEs is that the attack is almost entirely automated. An attacker can test a list of 100,000 credentials against a login page in under an hour using freely available tools. The cost to the attacker is near zero. The cost of a single successful login can be catastrophic for the target.
The NCSC Minimum Cyber Security Standard explicitly lists multi-factor authentication and unique passwords as baseline requirements for this reason. See our overview of the NCSC Minimum Cyber Security Standards for NZ businesses for what the full baseline looks like.
Three Things That Actually Stop Credential Stuffing
### 1. Multi-Factor Authentication
MFA is the single most effective control against credential stuffing because a stolen password alone is no longer sufficient. Even if the attacker has a valid username and password combination from a leaked database, they still need the second factor — which they do not have.
TOTP authenticator apps (Google Authenticator, Microsoft Authenticator) are significantly more resistant than SMS-based MFA, which is vulnerable to SIM-swap attacks. For your most sensitive systems — email, banking, payroll — authenticator apps should be the minimum standard.
### 2. Unique Passwords for Every Account
This is the direct fix the Groupon email recommends, and it is correct. If every account has a unique password, a breach at one company exposes credentials that are useless everywhere else. A password manager makes this practical — staff do not need to remember dozens of unique passwords, just one master password to access the vault.
For business accounts, enforcing unique passwords through your identity provider and disabling password reuse in Active Directory or Entra ID removes the human decision entirely.
### 3. Staff Awareness Training
Neither MFA nor password managers work if staff do not understand why they matter or how to use them. Training on credential stuffing specifically — using real examples like the Groupon notification — is significantly more effective than abstract policy documents.
When staff understand that a breach at a shopping site they used three years ago could give an attacker access to their work email today, the behaviour change follows naturally. SecureAZ security awareness modules cover credential-based attacks including credential stuffing, phishing, and business email compromise in a format designed for non-technical staff.
What to Do This Week
If you have not already done so:
- Enable MFA on Microsoft 365, Google Workspace, and any other business-critical platforms immediately. This is the highest-leverage single action.
- Check whether your business email addresses appear in known breach databases using Have I Been Pwned (haveibeenpwned.com). If they do, require password resets for affected accounts.
- Audit which systems your staff can access without MFA and prioritise those for remediation.
- Consider a password manager for your business — most modern identity platforms include one, and standalone options are available at low cost.
- Run security awareness training that specifically covers credential stuffing so staff understand the risk and the reason behind your controls.
The Groupon email is a helpful nudge. The question is whether your business acts on it before an attacker does.
Start protecting your staff with SecureAZ security awareness training