Norton LifeLock account credential stuffing with Password Manager exposure
Gen Digital detected a high volume of failed logins to Norton accounts on December 12, 2022 and found a credential stuffing attack that began around December 1. It notified about 6,450 customers in January 2023 and said it could not rule out that attackers also read vaults in Norton Password Manager, especially where the vault key matched the account password.
- Victim
- Gen Digital (Norton LifeLock)
- Industry
- Technology
- Country
- United States
- Intrusion began
- Dec 1, 2022
- First disclosed
- Jan 16, 2023
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 6,453 (Individuals, per Gen Digital's notice to the Maine attorney general. Some reports round to about 6,450.)
- Disclosed cost
- Not disclosed
The identity lesson
Breached-password screening, bot defenses and mandatory MFA on the account that guards a password vault would have stopped reused passwords from opening it.
Go deeper on SWI
- Technique: Credential stuffing
Sources
- Norton Password Manager accounts at risk after attack, BankInfoSecurity, Jan 16, 2023
- NortonLifeLock warns customers about potential Password Manager breach, HIPAA Journal, Jan 17, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). Norton LifeLock account credential stuffing with Password Manager exposure. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-norton-lifelock-credential-stuffing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.