CONFERENCE On Demand: Cyber AI & Automation Summit - Watch Now
Connect with us

Hi, what are you looking for?



US Teen Pleads Guilty to Credential Stuffing Attack on Fantasy Sports Website

Wisconsin teenager Joseph Garrison has admitted in court to launching a credential stuffing attack on a betting website.

Wisconsin teenager Joseph Garrison has pleaded guilty to his involvement in a scheme to access user accounts at a fantasy sports and betting website.

According to court documents, on November 18, 2022, Garrison launched a credential stuffing attack against the betting site, obtaining access to approximately 60,000 user accounts.

The defendant and others then stole about $600,000 from approximately 1,600 victim accounts, by adding a new payment method to the accounts, depositing $5 to each account using the new payment method, and then withdrawing all victim funds.

Law enforcement searched Garrison’s home in February 2023 and discovered software typically used for credential stuffing attacks on his computer, along with approximately 700 config files for these applications.

Additionally, nearly 40 million usernames and passwords that could be used in credentials stuffing attacks were found on his computer.

While searching Garrison’s phone, the investigators said they discovered conversations about hacking the betting website and using the compromised accounts for profit, either by stealing funds or by selling the accounts to cybercriminals.

Garrison, 19, of Madison, Wisconsin, pleaded guilty to conspiracy to commit computer intrusion and faces up to five years in prison.

The US Department of Justice announced charges against Garrison on May 18. The teen surrendered on the same day, in New York, New York.

Advertisement. Scroll to continue reading.

The documents presented in court do not mention the targeted website, which appears to be DraftKings. In November 2022, the site announced that roughly 68,000 user accounts had been compromised in a credential stuffing attack.

Such attacks involve the use of usernames and passwords obtained from other data breaches to log into accounts that the same individuals have on other websites and which are protected using the same credential pairs.

Related: US Announces IPStorm Botnet Takedown and Its Creator’s Guilty Plea

Related: Twitter Celebrity Hacker Pleads Guilty in US

Related: Owner of Cybercrime Website BreachForums Pleads Guilty

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.