Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

DraftKings Data Breach Impacts Personal Information of 68,000 Customers

Sports betting firm DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach.

The incident, initially disclosed in November, was the result of a credential stuffing attack and not a breach of DraftKings’ systems, the company says.

Sports betting firm DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach.

The incident, initially disclosed in November, was the result of a credential stuffing attack and not a breach of DraftKings’ systems, the company says.

Credential stuffing involves the use of leaked credentials (usernames, email addresses, and passwords) obtained from a third-party source to access an account on a different service. Such attacks are successful only because some individuals use the same credentials for accounts on different services.

DraftKings also announced at the time that the attackers withdrew roughly $300,000 from some of the compromised accounts, and that it would restore all the stolen funds.

On Friday, the company started sending out notification letters to the impacted customers, to inform them that some of their personal information might have been compromised during the incident, reiterating that the attackers used leaked credentials to access the accounts.

“Based on our investigation to date, we believe that attackers may have previously gained access to your username or email address and password from a non-DraftKings source and then used those credentials to access your DraftKings account,” a notification letter sent to impacted customers reads.

DraftKings says that personal information potentially compromised in the attack may include names, addresses, phone numbers, email addresses, profile photos, account balance, the last four digits of a payment card, details about prior transactions, and the date of the last password change.

The company also notes that it has no evidence that Social Security numbers, driver’s license numbers, or financial account numbers were compromised in the attack and underlines that it does not store full payment card numbers, card expiration dates, or CVVs.

Immediately after identifying the incident, the company prompted the impacted customers to reset their accounts’ passwords and is now urging them once again to reset their passwords and to review their account and credit reports to identify any suspicious activity.

“We have restored amounts that have been withdrawn from certain accounts in connection with credential stuffing attacks, as determined and identified by DraftKings,” the company says.

DraftKings informed the Maine Attorney General that a total of 67,995 individuals were impacted in the data breach.

Related: Personal Information of 123K Individuals Exposed in City of Tucson Data Breach

Related: California County Says Personal Information Compromised in Data Breach

Related: Data Breach at Shields Health Care Group Impacts 2 Million Patients

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...