Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

DraftKings Data Breach Impacts Personal Information of 68,000 Customers

Sports betting firm DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach.

The incident, initially disclosed in November, was the result of a credential stuffing attack and not a breach of DraftKings’ systems, the company says.

Sports betting firm DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach.

The incident, initially disclosed in November, was the result of a credential stuffing attack and not a breach of DraftKings’ systems, the company says.

Credential stuffing involves the use of leaked credentials (usernames, email addresses, and passwords) obtained from a third-party source to access an account on a different service. Such attacks are successful only because some individuals use the same credentials for accounts on different services.

DraftKings also announced at the time that the attackers withdrew roughly $300,000 from some of the compromised accounts, and that it would restore all the stolen funds.

On Friday, the company started sending out notification letters to the impacted customers, to inform them that some of their personal information might have been compromised during the incident, reiterating that the attackers used leaked credentials to access the accounts.

“Based on our investigation to date, we believe that attackers may have previously gained access to your username or email address and password from a non-DraftKings source and then used those credentials to access your DraftKings account,” a notification letter sent to impacted customers reads.

DraftKings says that personal information potentially compromised in the attack may include names, addresses, phone numbers, email addresses, profile photos, account balance, the last four digits of a payment card, details about prior transactions, and the date of the last password change.

The company also notes that it has no evidence that Social Security numbers, driver’s license numbers, or financial account numbers were compromised in the attack and underlines that it does not store full payment card numbers, card expiration dates, or CVVs.

Advertisement. Scroll to continue reading.

Immediately after identifying the incident, the company prompted the impacted customers to reset their accounts’ passwords and is now urging them once again to reset their passwords and to review their account and credit reports to identify any suspicious activity.

“We have restored amounts that have been withdrawn from certain accounts in connection with credential stuffing attacks, as determined and identified by DraftKings,” the company says.

DraftKings informed the Maine Attorney General that a total of 67,995 individuals were impacted in the data breach.

Related: Personal Information of 123K Individuals Exposed in City of Tucson Data Breach

Related: California County Says Personal Information Compromised in Data Breach

Related: Data Breach at Shields Health Care Group Impacts 2 Million Patients

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.