An 18-year-old from Wisconsin is charged with hacking a fantasy and sports betting site last year, when a major operator reported a similar issue.
Officials announced Thursday the unsealing of a six-count criminal complaint in connection with an alleged “scheme” to hack the user accounts of a legal sportsbook and sell access to those accounts to steal hundreds of thousands of dollars in funds.
According to the press release from the U.S. Attorney's Office for the Southern District of New York, Joseph Garrison allegedly launched a “credential stuffing attack” on the site last November, and he and others accessed around 60,000 accounts.
“During a credential stuffing attack, a cyber threat actor collects stolen credentials, or username and password pairs, obtained from other large-scale data breaches of other companies, which can be purchased on the dark web,” the release explained. “The threat actor then systematically attempts to use those stolen credentials to obtain unauthorized access to accounts held by the same user with other companies and providers in order to compromise accounts where the user has maintained the same password.”
Search conducted
In some instances, the release said, the alleged attackers added a new payment method to the account and then withdrew all of its funds using that method, to the tune of around $600,000 in stolen funds from approximately 1,600 accounts.
A search of Garrison's home by law enforcement in February 2023 allegedly turned up computer programs "typically used" for credential-stuffing attacks and files with almost 40 million username and password pairs, the release said.
“On Garrison’s cellphone, law enforcement also located conversations between Garrison and his co-conspirators, which included discussions about how to hack the Betting Website and how to profit from the hack of the Betting Website by extracting funds from the Victim Accounts directly or by selling access to the Victim Accounts,” it added. “In one particular conversation, Garrison discussed, in substance and in part, how successful he was at credential stuffing attacks, how much he enjoyed credential stuffing attacks, and how Garrison believed that law enforcement would not catch or prosecute him.”
DraftKings reported similar issue
Garrison is now facing six charges with potentially lengthy jail sentences, although none of the accusations have been proven in court. The release said he is charged with conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud, and aggravated identity theft. Garrison surrendered in New York on Thursday and was to go before a judge that afternoon.
While the release did not name the betting website that was allegedly affected, the details are similar to those reported by DraftKings last year.
Furthermore, a DraftKings spokesperson said on Thursday that they worked with law enforcement to catch the alleged bad actors.
“The safety and security of our customers’ personal and payment information is of paramount importance to DraftKings,” the spokesperson said. “As we stated previously, bad actor(s) were able to use login credentials obtained from a third-party source to gain access to certain user accounts. When the identified credential stuffing incident occurred in November 2022, DraftKings provided notice to customers in relevant jurisdictions and restored amounts for a limited number of users who may have had funds improperly withdrawn from their accounts.”
