DRAFTKINGS WARNS OF ACCOUNT BREACHES IN CREDENTIAL STUFFING ATTACKS

Summary from the TLDR InfoSec newsletter

DraftKings disclosed a credential stuffing attack where threat actors used stolen username/password combinations from external breaches to gain unauthorized access to customer accounts, exposing names, addresses, phone numbers, email addresses, and partial payment card information. The company is requiring affected users to reset passwords and enable multi-factor authentication. This is DraftKings' second major credential stuffing incident since 2022, when attackers previously stole up to $300,000 from compromised accounts. The attack highlights the ongoing vulnerability of organizations to credential reuse attacks, where users' poor password hygiene across multiple platforms enables account takeovers even when the targeted company's own systems remain secure.