DraftKings warns of account breaches in credential stuffing attacks

DraftKings, a leading online sports betting and gaming company, has issued a warning regarding recent account breaches caused by credential stuffing attacks. These attacks involve cybercriminals using automated tools to try large volumes of stolen username and password combinations to gain unauthorized access to user accounts. The company has observed an increase in such attacks targeting its platform, leading to unauthorized account access and potential misuse of user information. Credential stuffing is a prevalent cyber threat exploiting the reuse of passwords across multiple sites. Attackers leverage leaked credentials from unrelated data breaches to infiltrate accounts on other platforms, including DraftKings. Once inside, they may engage in fraudulent activities such as unauthorized bets, withdrawals, or changes to account settings. DraftKings has implemented enhanced security measures to detect and mitigate these attacks, including multi-factor authentication (MFA), monitoring for suspicious login patterns, and encouraging users to adopt strong, unique passwords. The company advises all users to enable MFA and regularly update their passwords to reduce the risk of compromise. This incident highlights the broader cybersecurity challenge posed by credential stuffing attacks across the online gaming and betting industry. Users are urged to remain vigilant and practice good password hygiene to protect their accounts. DraftKings continues to monitor the situation closely and collaborate with cybersecurity experts to strengthen its defenses against evolving threats. In conclusion, the DraftKings credential stuffing breaches serve as a critical reminder of the importance of robust cybersecurity practices for both companies and users. By adopting proactive security measures and staying informed about emerging threats, the online gaming community can better safeguard its digital assets and personal information.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 07 Oct 2025 19:10:14 +0000


Cyber News related to DraftKings warns of account breaches in credential stuffing attacks

DraftKings warns of account breaches in credential stuffing attacks - DraftKings, a leading online sports betting and gaming company, has issued a warning regarding recent account breaches caused by credential stuffing attacks. These attacks involve cybercriminals using automated tools to try large volumes of stolen ...
14 hours ago Bleepingcomputer.com
Teenager Who Allegedly Bragged 'Fraud Is Fun' Pleads Guilty To Sports Betting Hack - A Wisconsin man pleaded guilty to a hacking scheme that stole about $600,000 from more than a thousand DraftKings accounts, prosecutors said Wednesday, months after accusing the 19-year-old defendant of telling a co-conspirator "Fraud is fun"-as the ...
1 year ago Forbes.com
US charges two more suspects with DraftKing account hacks - The U.S. Department of Justice arrested and charged two more suspects for their involvement in the hacking of almost 68,000 DraftKings accounts in a November 2022 credential stuffing attack. One month later, DraftKings said it had refunded hundreds ...
1 year ago Bleepingcomputer.com
What is Credential Harvesting? Examples & Prevention Methods - Credential harvesting is a serious threat to your organization's online security and privacy. Understanding how credential harvesting attacks work is crucial in safeguarding your personal and business data. Common Techniques Used in Credential ...
1 year ago Securityboulevard.com
Okta warns of credential stuffing attacks targeting its CORS feature - Okta warns that a Customer Identity Cloud feature is being targeted in credential stuffing attacks, stating that numerous customers have been targeted since April. Okta is a leading identity and access management company providing cloud-based ...
1 year ago Bleepingcomputer.com LockBit
New 'Atlantis AIO' automates credential stuffing on 140 services - Credential stuffing is a type of cyberattack where threat actors try out a list of credentials (usernames + passwords) they stole or sourced from leaked data breaches against platforms hoping to gain access to accounts. Specifically, Atlantis AIO ...
6 months ago Bleepingcomputer.com
How to defend against credential stuffing attacks - Protecting against credential stuffing attacks requires a multi-layered approach to security. Implement Multi-Factor Authentication: Require users to provide additional forms of authentication, such as a one-time code sent to their mobile device or a ...
1 year ago Cybersecurity-insiders.com
Over 15,000 hacked Roku accounts sold for 50¢ each to buy hardware - Roku has disclosed a data breach impacting over 15,000 customers after hacked accounts were used to make fraudulent purchases of hardware and streaming subscriptions. BleepingComputer has learned there is more to this attack, with threat actors ...
1 year ago Bleepingcomputer.com
Critical insights into Australia's supply chain risk landscape - Australian organizations find themselves navigating a minefield of supply chain risks, with a surge in incidents stemming from multi-party breaches. These breaches are often caused by vulnerabilities in cloud or software providers and are emerging as ...
1 year ago Tripwire.com
Jason's Deli Restaurant Chain Hit by a Credential Stuffing Attack - The personal information of more than 340,000 customers of popular restaurant chain Jason's Deli may have been victims of a credential stuffing attack, a scheme in which the hacker uses stolen or leaked credentials to log into other online accounts. ...
1 year ago Securityboulevard.com
North Korean Hackers Utilizing Credential Stuffing to Launch Cyberattacks - In an alarming new report, researchers found that North Korean-linked hackers have been using stolen passwords during cyberattacks to gain access to various government, military and financial networks. According to security experts, the creative ...
2 years ago Thehackernews.com
The biggest cybersecurity and cyberattack stories of 2023 - Genetic testing provider 23andMe suffered credential stuffing attacks that led to a major data breach, exposing the data of 6.9 million users. The company states that the attackers only breached a small number of accounts during the ...
1 year ago Bleepingcomputer.com Scattered Spider Black Basta
PayPal Warns 35,000 Users of Credential Stuffing Attacks - PayPal has warned 35,000 users that they may be vulnerable to credential stuffing attacks after a security breach. Credential stuffing is a type of attack in which hackers use lists of breached user credentials to attempt to gain access to an ...
2 years ago Securityweek.com
Massive 'New' Leaked Credentials List: Naz.API Pwns Troy - Almost 71 million sets of unique credentials have leaked, via an unnamed firm's bug bounty program. Nicknamed Naz.API, the leak is making waves. The site's majordomo, Troy Hunt, sounds astounded. Credential stuffing lists are collections of login ...
1 year ago Securityboulevard.com
23andMe failed to detect mega-breach attackers for 5 months The Register - Biotech and DNA-collection biz 23andMe, the one that blamed its own customers for the October mega-breach, just admitted it failed to detect any malicious activity for the entire five months attackers were breaking into user accounts. In a collection ...
1 year ago Go.theregister.com
How To Correlate Web Logs And Network Indicators To Track Credential Theft - To effectively detect credential theft, organizations must collect and analyze logs from a variety of sources, including web servers, authentication systems, proxies, DNS servers, endpoint protection platforms, and network monitoring tools. Common ...
5 months ago Cybersecuritynews.com
PayPal Data Breach - Overview of the Credential Stuffing Incident - PayPal recently experienced a data breach through the use of credential stuffing, a method of taking previously compromised username and password combinations from other websites and attempting to use them on PayPal accounts. The breach, which could ...
2 years ago Securityaffairs.com
Data Breaches in US Schools Exposed 37.6M Records - Since 2005, educational institutions in the United States have experienced 3713 data breaches, impacting over 37.6m records. According to new data by Comparitech, 2023 marked a record year, with 954 breaches recorded - a dramatic rise from 139 in ...
1 year ago Infosecurity-magazine.com
Australian pension funds hit by wave of credential stuffing attacks - Since the weekend attacks, some of the country's largest profit-to-member superannuation funds with millions of members each and managing tens or hundreds of billions—including AustralianSuper, Hostplus, REST and Australian Retirement Trust, ...
6 months ago Bleepingcomputer.com
Ta444 Turn Credential Harvesting Activity: A Comprehensive Guide - The Ta444 cyber threat group is one of the most active cybercriminals in the world, and one of their notable methods is credential harvesting. Credential harvesting is the process of stealing user’s information, such as usernames, passwords, credit ...
2 years ago Securityaffairs.com
Have I Been Pwned adds 71 million emails from Naz.API stolen account list - Have I Been Pwned has added almost 71 million email addresses associated with stolen accounts in the Naz.API dataset to its data breach notification service. The Naz.API dataset is a massive collection of 1 billion credentials compiled using ...
1 year ago Bleepingcomputer.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
Credential Leakage is Fueling a Rise in API Breaches - Data security is a paramount priority for organizations in today’s digital world. An increasingly common method of data breaches involves APIs, or application programming interfaces. A recent SecurityWeek article explores how credential leakage is ...
2 years ago Securityweek.com
41% of Success Logins Across Websites Involves Compromised Passwords - Password reuse continues to be one of the most significant security vulnerabilities in 2025, with alarming new data showing nearly half of all successful website logins involve previously exposed credentials. This widespread practice of recycling ...
6 months ago Cybersecuritynews.com
What Can Go Wrong with Bank Online Account Opening? - Online account opening is one of the most crucial functions for banks today. They pull out their driver's license and show it to the camera on the phone or on the PC. The bank checks some data and vets the driver's license and a new account is ...
1 year ago Securityboulevard.com

Cyber Trends (last 7 days)