DraftKings hacker admits to stealing $600,000 from customer accounts
A Madison, Wisconsin, teen pleaded guilty Wednesday to conspiracy to commit computer theft. The guilty plea involves the theft of more than $600,000 from approximately 1,600 DraftKings accounts.
Joseph Garrison, 18, who boasted to a co-conspirator that "cheating is fun," faces up to five years in federal prison.
According to prosecutors, the teen and others launched a credential stuffing attack on the DraftKings sportsbook on Nov. 18, 2022. Here, cybercriminals use login credentials that are often stolen during large-scale corporate data breaches and obtained on the dark web.
The hackers then use the stolen credentials to access the user's account with the same password.
Once inside, court documents say, Garrison and his associates were able to add a new payment method to the account, deposit $5 to verify the method, and then withdraw any existing funds.
"Addicted to Fraud"
Reports at the time said the attack caused DraftKings stock to drop 5% on Nasdaq. Investors are concerned about declining consumer confidence in mobile sports betting, which has recently launched in many new U.S. markets.
When the FBI searched Garrison's home in February 2023, they discovered credential stuffing software that had been used to target dozens of different corporate websites. Agents also found files on the suspect's computer containing nearly 40 million username and password pairs.
Meanwhile, prosecutors said conversations extracted from Garrison's phone included discussions about how to hack and exploit the DraftKings website.
"Fraud is fun," Garrison wrote to a co-conspirator, according to court documents. "I'm obsessed with seeing the money in the account. I'm obsessed with getting around shit."
$15,000 per day
A Wisconsin investigation found Garrison allegedly made more than $2.1 million through online fraud by the time he was 18. His activities earned him $15,000 per day between 2018 and 2021.
This wasn't Garrison's first run-in with the law. Just months before the DraftKings attack, he was charged with five counts of bomb threats, three counts of terrorist threats and one count of attempted bomb threats.
Prosecutors said it was related to Garrison's habit of hiring third parties over the Internet to pose threats to his school, Madison Memorial High School. He did this five times because he was "bored and wanted to go home," according to court documents.
Read also:
- Football 101: What is relegation in football?
- Detroit casino union reaches tentative deal to end strike
- New Mexican reforms aim to ban slot machines
- PGA Tour and Strategic Sports Group confirm player ownership offer
Source: www.casino.org
