In a tale of audacious hacking, an 18-year-old teenager named Joseph Garrison from Madison, Wisconsin, has been charged with orchestrating a sophisticated credential-stuffing break-in at the popular sports betting website, DraftKings.

The teenager's hacking spree allegedly led to $600,000 being drained from hundreds of customer accounts.

DraftKings cyber security team played a crucial role in identifying Garrison as the alleged perpetrator of the credential-stuffing attack. 

Through the company's investigation, they managed to repurchase some of the stolen credentials from the dark web. And ultimately traced them back to Garrison.

 Investigators found that the IP address used to sell the compromised account information matched the address associated with Garrison's parents' home, where he lives.

Credential-stuffing hack attack

Garrison allegedly purchased stolen log-in and password combinations from the dark web, using them to gain unauthorized access to approximately 60,000 accounts on DraftKings in November of last year. 

He then sold this valuable information to other individuals who utilized it to drain a total of 1,600 customer accounts. Federal prosecutors in Manhattan unveiled the details of the case against Garrison.

The hacking technique employed by Garrison is known as credential stuffing, a method that thrives when online users adopt the risky practice of using the same password and log-in credentials across multiple websites.

In a revealing text message to one of his co-conspirators, Garrison allegedly wrote, "Fraud is fun. I'm addicted to seeing money in my account."

While DraftKings is not specifically mentioned in the criminal complaint, the company confirmed that some of its customers' accounts had indeed fallen victim to the scheme. 

DraftKings took immediate action to restore the stolen funds. And emphasized its commitment to the safety and security of its customers' personal and payment information.

This incident isn't Garrison's first brush with the law. 

Teen hacker has over $2 million

He was already facing charges in a separate case in Wisconsin. And is suspected of employing Bitcoin payments to incentivize individuals to make bomb threats to the high school he attends in Madison and other cities where his friends resided.

 This practice, commonly referred to as "swatting," revealed a disturbing pattern of behavior. Court documents in Wisconsin indicated that Garrison requested a threat to be called in simply because he was bored and wanted to leave school early.

Garrison turned himself into authorities in New York and was set to appear before a judge. 

It remains unclear whether he has retained legal representation for the hacking case. An attorney who previously represented him in the swatting case has yet to respond to requests for comment.

During the investigation into the swatting case, Wisconsin police discovered evidence indicating Garrison's involvement in numerous hacking scams over several years. 

Astonishingly, by the age of 17, Garrison had amassed a fortune of $2.1 million. Although he told authorities he has ceased hacking activities, court documents revealed that he admitted to making an average of $15,000 per day from 2018 to 2021.

Michael Driscoll of the FBI highlighted the seriousness of these types of cyber intrusions. And said that if Garrison is found guilty of the website’s theft he will face time in prison.