FOLLOW US

In a tale of audacious hacking, an 18-year-old teenager named Joseph Garrison from Madison, Wisconsin, has been charged with orchestrating a sophisticated credential-stuffing break-in at the popular sports betting website, DraftKings.

The teenager's hacking spree allegedly led to $600,000 being drained from hundreds of customer accounts.

DraftKings cyber security team played a crucial role in identifying Garrison as the alleged perpetrator of the credential-stuffing attack. 

Through the company's investigation, they managed to repurchase some of the stolen credentials from the dark web. And ultimately traced them back to Garrison.

 Investigators found that the IP address used to sell the compromised account information matched the address associated with Garrison's parents' home, where he lives.

Credential-stuffing hack attack

Garrison allegedly purchased stolen log-in and password combinations from the dark web, using them to gain unauthorized access to approximately 60,000 accounts on DraftKings in November of last year. 

He then sold this valuable information to other individuals who utilized it to drain a total of 1,600 customer accounts. Federal prosecutors in Manhattan unveiled the details of the case against Garrison.

The hacking technique employed by Garrison is known as credential stuffing, a method that thrives when online users adopt the risky practice of using the same password and log-in credentials across multiple websites.

In a revealing text message to one of his co-conspirators, Garrison allegedly wrote, "Fraud is fun. I'm addicted to seeing money in my account."

While DraftKings is not specifically mentioned in the criminal complaint, the company confirmed that some of its customers' accounts had indeed fallen victim to the scheme. 

DraftKings took immediate action to restore the stolen funds. And emphasized its commitment to the safety and security of its customers' personal and payment information.

This incident isn't Garrison's first brush with the law. 

Teen hacker has over $2 million

He was already facing charges in a separate case in Wisconsin. And is suspected of employing Bitcoin payments to incentivize individuals to make bomb threats to the high school he attends in Madison and other cities where his friends resided.

 This practice, commonly referred to as "swatting," revealed a disturbing pattern of behavior. Court documents in Wisconsin indicated that Garrison requested a threat to be called in simply because he was bored and wanted to leave school early.