Post-incident review
Credential stuffing, nine hours in the dark
What the attackers did, how we found them, and the four controls we are shipping.
Security EngineeringFictional company, sample deckOctober 2026
Impact
Logged in from attacker infrastructure. 37 had saved payment methods; none were charged.
Source: auth logs, reviewed by two engineers
Timeline (UTC)
From first request to containment
Spray begins
Login attempts from 3,000 residential IPs.
Alert fires
Failure ratio crosses 40 percent.
Page acknowledged
On-call opens the incident channel.
Contained
Rate limits and forced resets live.
Failed logins per minute, peak window
Low and slow: the attack stayed under our per-IP limit all night.
| Hour | Failed logins |
|---|---|
| 02 | 40 |
| 04 | 120 |
| 06 | 380 |
| 08 | 910 |
| 10 | 240 |
Root cause
Threat, gap, consequence
Reused passwords from unrelated breaches, tried at scale.
Limits were per IP, no check against known-breached passwords, MFA optional.
412 sessions, 37 with stored payment methods, no card data exposed.
Detect on the target, not the source
Rate and anomaly rules keyed on accounts and on the failure ratio.
Controls: before and after
| Before | After | |
|---|---|---|
| Rate limit | Per IP | Per account and per device |
| Breached passwords | Not checked | Blocked at sign-in |
| MFA | Optional | Required for stored payments |
| Alert latency | 6.5 hours | Under 15 minutes |
Response plan
Four steps, in this order
Contain
Force resets on the 412 accounts.
Detect
Ship account-level anomaly alert.
Prevent
Breached-password check and MFA.
Verify
Replay the attack monthly.
Decisions we need today
- Approve required MFA for accounts with stored payments.
- Fund the replay harness: two engineers for one quarter.
- Agree the customer notice, to go out Thursday.
Questions
Blameless, specific, tested
Owner Security Engineeringsecurity@example.com