DraftKings Warns Users of Credential Stuffing Attacks

DraftKings has told users about a credential stuffing campaign that targeted their online accounts, with hackers reported to have accessed names, addresses, phone numbers, email addresses, and other information. The attacks were discovered on 2 September and relied on credentials harvested from other sources to log into affected accounts, according to a copy of the notification letter that was submitted to the Massachusetts OCABR.

The company says there is no evidence that login credentials were obtained from DraftKings or that its systems or networks were breached as part of the incident, and it notes no evidence that government-issued ID numbers or financial account details were compromised. As a precaution, DraftKings has launched an investigation and is requiring affected individuals to reset their account passwords and enable multifactor authentication for logins to DraftKings Horse accounts. The firm has not disclosed the number of users impacted.