The U.S. Department of Justice arrested and charged two more suspects for their involvement in the hacking of almost 68,000 DraftKings accounts in a November 2022 credential stuffing attack.
One month later, DraftKings said it had refunded hundreds of thousands of dollars stolen from 67,995 customers whose accounts were hijacked in the incident.
A third defendant, Joseph Garrison, was charged in May 2023 for his involvement in the same scheme targeting the fantasy sports and sports betting website.
In November, he also pled guilty to conspiring to commit computer intrusion in connection with this attack and will be sentenced on Thursday.
Credential stuffing attacks use automated tools to make millions of login attempts using a list of user/password pairs.
This technique is particularly effective against accounts where the owner has reused the same login information across multiple platforms.
According to the complaint, Nathan Austad and Garrison used a list of credentials collected from other breaches to hack into the DraftKings accounts and then sold access to the accounts to others who stole around $635,000 from roughly 1,600 compromised accounts.
Together, the defendants also devised a method allowing buyers of the stolen DraftKings accounts to withdraw all available funds.
While analyzing Austad's seized phone, law enforcement agents found more evidence implicating him in the DraftKings credential attack, including discussions with coconspirators regarding the hack.
Chick-fil-A also confirmed in March 2023 that 71,473 customers had their accounts breached following a months-long credential stuffing attack that targeted the platform between December 18th, 2022, and February 12th, 2023.
Garrison's Goat Shop was also selling stolen Chic-Fil-A accounts at the time, providing instructions on how buyers could use the stored rewards points.
Automated tools and aggregated stolen credentials fuel a massive surge of credential stuffing attacks, as the FBI warned almost two years ago.
Alleged BreachForums owner Pompompurin arrested on cybercrime charges.
US charged 19 suspects linked to xDedic cybercrime marketplace.
23andMe data breach: Hackers stole raw genotype data, health reports.
Tesla hacked again, 24 more zero-days exploited at Pwn2Own Tokyo.
Tesla hacked, 24 zero-days demoed at Pwn2Own Automotive 2024.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 30 Jan 2024 21:30:10 +0000