A brute force attack is one of the oldest techniques in cybercrime, and the classic version has quietly stopped working. Trying every possible password combination against a modern login page runs into account lockouts and rate limits long before it succeeds, which is why pure guesswork is no longer where the real threat lies. What replaced it is faster and quieter, because attackers in 2026 rarely need to guess a password when billions of real ones are already available to buy. The Verizon 2026 Data Breach Investigations Report found that stolen credentials remain the single most common way attackers gain their first access to a network.

The term still covers a family of related attacks, and knowing how they differ is worth the effort, because the defenses that stop one do little against another. Federal agencies have named healthcare as a direct target of these techniques.

Related: Types of cyber threats

Watch: What is a brute force attack?

 

What a brute force attack actually is

Every brute force attack runs on automation. Rather than a person typing guesses, a script cycles through username and password combinations at machine speed until one works. The attack targets weak, reused, or predictable passwords rather than any flaw in the software itself, which separates it from an exploit that breaks a system through a coding vulnerability.

The classic form, sometimes called simple brute force, works through every possible combination in sequence. Modern computing power has made it genuinely dangerous against short or simple passwords, which can be worked out in minutes. Against a login page that locks an account after a handful of failed attempts, though, it rarely gets far, and that limitation is what pushed attackers toward the smarter variants below.

Academic work on the problem draws the same line between the old technique and its newer forms. A 2024 study on detecting brute-force attacks against corporate email, published in the Journal of Computational Methods in Sciences and Engineering, separated conventional brute-force attacks, which analysis of login logs and traffic can reliably flag, from the quieter distributed variants that slip past that same analysis. The researchers built machine-learning models specifically to catch what rule-based monitoring misses, which points to where the real difficulty now sits.

Read also: What is a phishing attack? | What is credential stuffing?

 

The different types of brute force attacks

Dictionary attacks

A dictionary attack narrows the guesswork. Rather than trying every combination, it runs through a prepared list of likely passwords, common words, names, predictable patterns, and passwords already known to be popular from previous breaches. Because most people choose passwords that are easy to remember, a well-built list succeeds far more often than random guessing and uses a fraction of the attempts to do it.

 

Credential stuffing

Credential stuffing is the variant driving most of the damage in 2026, and it barely resembles the original technique. Rather than guessing anything, the attacker starts with real username and password pairs stolen from an earlier breach and tries them against other services, betting that people reuse the same login across multiple sites. The supply feeding these attacks is vast, with the Verizon 2026 Data Breach Investigations Report documenting billions of passwords circulating on criminal forums and the overwhelming majority failing basic complexity requirements. When a healthcare employee reuses a password that leaked from an unrelated consumer website, credential stuffing turns that reuse into a working login on a system holding patient data.

 

Password spraying

Password spraying flips the logic of a traditional attack. Instead of trying many passwords against one account, which triggers a lockout, it tries a few very common passwords against many accounts at once. A seasonal word with the current year and a symbol, tried a single time against every mailbox in an organization, stays under the failed-attempt threshold that would otherwise raise an alarm.

That low-and-slow pattern is also what makes spraying so hard to catch. The same 2024 study found that conventional detection methods "fail to detect low-frequency and distributed brute-force attack behaviors," a precise description of how a spraying campaign operates. Paubox's analysis of password spraying in healthcare documented campaigns that ran for months without triggering alerts, often by targeting older login protocols that security teams watch less closely.

 

Why healthcare is a named target

The threat is documented, not theoretical. In their joint advisory, CISA, the FBI, and the NSA warned that Iranian cyber actors had been using brute force techniques, including password spraying, along with multi-factor authentication push bombing, to break into accounts across critical infrastructure, and healthcare and public health were named among the primary targets. The advisory noted the actors aimed to obtain valid credentials and details about victim networks, which they could then sell to other criminals, feeding the same underground market that supplies credential stuffing campaigns everywhere else.

Healthcare draws this attention for the reasons it always has. Patient records hold lasting value, clinical systems cannot tolerate downtime, and the sector runs a large number of accounts across email, remote access, and clinical applications, each one a potential door. The more accounts an organization runs, the more surface a password spraying campaign has to work with.

 

Why MFA alone no longer stops them

Multi-factor authentication was supposed to close this problem, and for a while it did, until attackers adapted. MFA push bombing, sometimes called MFA fatigue, is the technique named in the federal advisory alongside password spraying. Once an attacker holds a valid password, they attempt to log in over and over, sending a stream of approval prompts to the victim's phone until, worn down or confused, the person taps approve just to make the notifications stop. The password holds but the second factor is handed over anyway. The same advisory noted that once inside, the actors often changed the MFA settings on compromised accounts to keep their access.

The form of MFA now matters as much as its presence, and the weaker forms have become a target rather than a wall.

Read more: What is MFA?

 

What actually stops these attacks

No single control covers the whole family, so the effective approach layers several.

Account lockouts and rate limiting remain the baseline against simple brute force and dictionary attacks, cutting off an automated script after a set number of failed attempts. They do little against password spraying, which stays deliberately under those thresholds, so they cannot stand alone.

Phishing-resistant multi-factor authentication is the strongest control against the credential-based variants. Standards like FIDO2 and passkeys, which are login methods that tie authentication to a physical device and the real site's address rather than a code a user can be tricked into approving, defeat push bombing because there is no prompt to fatigue and no code to relay. Federal guidance in the joint advisory points toward these methods precisely because the older forms of MFA have proven bypassable.

Unique passwords for every account break credential stuffing at its foundation, since a password that exists nowhere else cannot be reused against another system. Password managers make that practical across the dozens of accounts a healthcare worker holds. Monitoring login patterns for unusual geography or volume helps catch a spraying campaign while it is underway, though the researchers behind the 2024 corporate-email study concluded that catching distributed attacks reliably takes detection that learns what normal login behavior looks like rather than matching fixed thresholds. That behavioral principle, learning normal patterns rather than checking against a static rule, is the same one that separates modern email filtering from the older signature-based tools attackers have learned to slip past.

There is also the supply side, which is where email security enters. Credential stuffing and password spraying both run on stolen credentials, and a large share of those credentials were originally harvested through phishing emails that tricked someone into entering their login on a fake page. Cutting off that harvest shrinks the pool of working credentials feeding the next attack. Paubox's 2025 Healthcare Email Security Report found that employees report only 5% of known phishing attempts to their security teams, so the messages stealing those credentials almost always reach their target. Paubox's 2026 Healthcare Email Security Report tracked a 47% rise in attacks avoiding native email defenses in 2025. Paubox Inbound Email Security uses AI to analyze sender behavior, message intent, and contextual signals, removing the credential-harvesting phishing emails that stock the criminal market before a staff member ever sees them.

Learn more: Paubox Inbound Email Security

 

In the news

A brute force attack sits behind one of the clearest enforcement actions HHS has taken in healthcare. On October 31, 2024, the HHS Office for Civil Rights announced a settlement with Plastic Surgery Associates of South Dakota following a 2017 breach that exposed the protected health information of 10,229 individuals. Investigators found the attacker had broken in through a brute force attack on the organization's remote desktop protocol, the feature that lets staff log into a workstation from off-site, then deployed ransomware across nine workstations and two servers. Unable to restore the affected servers from backups, the practice paid roughly $27,000 in Bitcoin for decryption keys. OCR's investigation pointed to gaps in the organization's risk analysis and security safeguards, the same foundational controls that would have made the initial brute force attempt far harder to land. The case is a reminder that a guessed or forced login on a single exposed remote-access point can end in a full ransomware event, a regulatory settlement, and years of fallout.

 

FAQs

What is the difference between brute force and credential stuffing?

Simple brute force guesses passwords by trying combinations until one works, while credential stuffing skips the guessing entirely and reuses real username and password pairs stolen from an earlier breach. Credential stuffing succeeds because so many people reuse the same login across multiple services, and it has become far more common than pure guessing.

 

Why doesn't account lockout stop every brute force attack?

Lockouts cut off an attacker after a set number of failed attempts on a single account, which stops simple brute force and dictionary attacks. Password spraying works around this by trying only a few common passwords against many accounts, staying under the failed-attempt threshold so no single account ever locks.

 

Is healthcare specifically targeted by these attacks?

Yes. A joint advisory from CISA, the FBI, and the NSA named healthcare and public health among the sectors targeted by Iranian actors using password spraying and MFA push bombing to compromise accounts. Healthcare's large number of user accounts and the lasting value of patient data make it a consistent target.

 

Does multi-factor authentication stop brute force attacks?

It helps but no longer guarantees protection. Attackers use MFA push bombing, sending repeated approval prompts until a worn-down user taps approve, to get past the weaker forms of MFA. Phishing-resistant methods like FIDO2 and passkeys close that gap because there is no prompt to fatigue and no code to trick a user into sharing.

 

How does email security relate to password attacks?

Credential stuffing and password spraying run on stolen credentials, and many of those were harvested through phishing emails that captured logins on fake pages. Pre-delivery email filtering that removes those phishing messages before staff interacts with them shrinks the supply of working credentials that fuels the next round of attacks.

See also: HIPAA Compliant Email: The Definitive Guide