[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573795-105":53,"doc-detail-573795-en":120},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":113,"head_meta":115,"extra_data":117,"updated_unix":119},105,"en","credential-stuffing-guidelines-27th-june-2022","Credential Stuffing Guidelines - 27th June 2022","","The document sets out credential stuffing as a cross-border privacy enforcement concern and explains how this threat targets personal data. It describes the IEWG within the Global Privacy Assembly and the mandate to support actions under the GPA’s 2021–23 regulatory and enforcement cooperation plan. It outlines why credential stuffing attacks occur and summarizes recognised organisational measures to detect, prevent, and mitigate associated risks, noting that it does not create binding legal obligations across all jurisdictions.",{"@graph":63,"@context":112},[64,80,95],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/credential-stuffing-guidelines-27th-june-2022/573795/",4,{"url":78,"name":59,"@type":81,"author":82,"headline":59,"publisher":85,"fileFormat":88,"inLanguage":57,"description":61,"dateModified":89,"datePublished":89,"encodingFormat":88,"isAccessibleForFree":90,"interactionStatistic":91},"DigitalDocument",{"name":83,"@type":84},"Riley West","Person",{"url":68,"name":86,"@type":87},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":92,"interactionType":93,"userInteractionCount":4},"InteractionCounter",{"@type":94},"ViewAction",{"@type":96,"mainEntity":97},"FAQPage",[98,104,108],{"name":99,"@type":100,"acceptedAnswer":101},"What is credential stuffing and why is it a privacy concern?","Question",{"text":102,"@type":103},"Credential stuffing involves attempts to abuse credentials in ways that can compromise access and expose personal data. The document treats it as a rising threat to personal information and a matter for privacy enforcement cooperation.","Answer",{"name":105,"@type":100,"acceptedAnswer":106},"How was the work on these guidelines initiated?",{"text":107,"@type":103},"The IEWG identified credential stuffing as a concern at a closed enforcement session in March 2021. A sub-working group was then created to develop material to help authorities address the threat.",{"name":109,"@type":100,"acceptedAnswer":110},"What do the guidelines recommend organizations do?",{"text":111,"@type":103},"They identify recognised measures that organizations can use to mitigate the risk to personal data, including actions to detect, prevent, and mitigate credential stuffing threats.","https://schema.org",{"og:url":78,"og:type":114,"og:title":59,"og:site_name":86,"og:description":61},"article",{"robots":116,"canonical":78},"index,follow",{"doc_id":118,"site_id":56},573795,1791946378,{"code":4,"msg":5,"data":121},{"doc_id":118,"user_id":122,"nickname":83,"user_avatar":123,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":124,"file_id":125,"file_url":126,"file_type":127,"file_size":128,"view_count":4,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":129,"language":130,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":131,"faqs":132,"seo_title":133,"seo_description":61,"update_tm":119,"read_time":134},1099523885074,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","International Enforcement Cooperation Working Group  \nCredential Stuffing Guidelines – 27th June 2022 Credential stuffing sub-working group authorities:  \n• Office of the Privacy Commissioner of Canada  \n• Gibraltar Regulatory Authority  \n• Jersey Office of the Information Commissioner  \n• Switzerland’s Federal Data Protection and Information Commissioner  \n• Turkey’s Data Protection Authority  \n• United Kingdom’s Information Commissioner’s Office  \nTable of Contents  \nExecutive Summary ............................................................................................................................................. 3  \nAcknowledgements ............................................................................................................................................. 4  \n1. Introduction ..................................................................................................................................................... 9  \n2. How does credential stuffing work?.............................................................................................................. 10  \n3. Why are credential stuffing attacks carried out? .......................................................................................... 12  \n4. Growing global concerns ............................................................................................................................... 15  \n5. Examples of credential stuffing cases ........................................................................................................... 17  \n6. Data security in privacy and data protection law.......................................................................................... 19  \n7. Measures to detect, prevent and mitigate the risk of credential stuffing .................................................... 20  \nExecutive Summary  \nThe International Enforcement Cooperation Working Group (IEWG) is a permanent Working Group of the Global Privacy Assembly (GPA), which is co-chaired by: the Office of the Privacy Commissioner of Canada; the Office of the Privacy Commissioner for Personal Data, Hong Kong, China; the Superintendence of Industry and Commerce of Colombia; and the Norwegian Data Protection Authority.  \nThe work ofthe IEWG is integral to the GPA, supporting its strategic ambitions around leadership, cooperation, and advancing global privacy in a digital age. In particular, the IEWG has primary responsibility for leading on delivery of actions under the Regulatory and enforcement cooperation Pillar of the GPA’s 2021-23 Strategic Plan.  \nCredential stuffing was identified as an area of concern by the IEWG at a Closed Enforcement Session1 in March 2021. As a result, follow up action was agreed and a sub-working group (SWG) of the IEWG was created to work on the topic and produce material that aims to assist authorities to address the rising threat of credential stuffing.  \nThese guidelines identify the threat of credential stuffing to personal data and recognised measures that organisations can use to mitigate the risk to personal data. While these guidelines do not represent a statement of legal obligations across all jurisdictions, they may assist organisations in complying with data protection and privacy laws, which will generally require organisations to adequately protect personal information against threats like those posed by credential stuffing attacks.  \n1 Closed Enforcement Sessions are the way in which the IEWG identifies and examines significant issues or organisations, with global implications for people’s data protection and privacy rights, and acts as a platform to promote and support practical enforcement cooperation, as appropriate. Typically, Closed Enforcement Sessions begin with a presentation on a topic, followed by an open discussion on key concerns, regulatory approaches, and opportunities for cooperation.  \nAcknowledgements  \nThese guidelines have benefitted from, and incorpor","cbCaij1L9sFtSmw5","https://ap.wps.com/l/cbCaij1L9sFtSmw5","pdf",828863,29,"English","# Executive Summary\n# Acknowledgements\n# Introduction\n# How does credential stuffing work?\n# Why are credential stuffing attacks carried out?\n# Growing global concerns\n# Examples of credential stuffing cases\n# Data security in privacy and data protection law\n# Measures to detect, prevent and mitigate the risk of credential stuffing","[{\"question\":\"What is credential stuffing and why is it a privacy concern?\",\"answer\":\"Credential stuffing involves attempts to abuse credentials in ways that can compromise access and expose personal data. The document treats it as a rising threat to personal information and a matter for privacy enforcement cooperation.\"},{\"question\":\"How was the work on these guidelines initiated?\",\"answer\":\"The IEWG identified credential stuffing as a concern at a closed enforcement session in March 2021. A sub-working group was then created to develop material to help authorities address the threat.\"},{\"question\":\"What do the guidelines recommend organizations do?\",\"answer\":\"They identify recognised measures that organizations can use to mitigate the risk to personal data, including actions to detect, prevent, and mitigate credential stuffing threats.\"}]","Credential Stuffing Guidelines - 27th June 2022 | PDF",10]