A swaggering teenage hacker has been accused of masterminding the hack of sports activities betting web site DraftKings, which led to the draining of $600,000 from lots of of shoppers.
Joseph Garrison, 18, of Madison, Wis., is accused of utilizing stolen login and password combos he bought on the darkish net to hack into 60,000 DraftKings accounts final November. He then offered the data to others who used it to wash out 1,600 buyer accounts, federal prosecutors in Manhattan stated.
This hacking approach is called credential stuffing, which works finest when on-line customers use the identical password and login identify on a number of websites.
“Fraud is enjoyable,” Garrison allegedly wrote in a textual content message to 1 co-conspirator, in keeping with courtroom paperwork. “I am hooked on having cash in my account.”
DraftKings was not named within the prison grievance, however the firm confirmed that a few of its prospects’ accounts have been hacked as a part of the scheme and stated it has returned the stolen cash.
“The safety of our prospects’ private and fee data is of the utmost significance to DraftKings,” the corporate stated in a press release.
On the time of the hack, Garrison had already been charged in a separate case in Wisconsin for allegedly paying folks in bitcoin on-line to make bomb threats to his personal highschool in Madison and different cities the place his associates lived, a follow often known as “browsing,” in keeping with from courtroom paperwork. In a single such name, Garrison allegedly requested to make the risk as a result of he was bored and needed to go dwelling, in keeping with courtroom data in Wisconsin.
Garrison surrendered to authorities in New York on Thursday morning and was scheduled to look earlier than a decide later that day. It was not instantly clear whether or not he had employed an legal professional within the hacking case, and the legal professional who represented him within the earlier hacking case didn’t instantly reply to a message in search of remark.
Throughout their investigation into the case, Wisconsin police uncovered proof that Garrison had been concerned in a sequence of hacking scams over time and had amassed $2.1 million by the age of 17. He admitted that as of 2018, he was making a median of $15,000 a day. till 2021, however informed investigators he had stopped taking part in any hacking actions, courtroom paperwork stated.
However 5 months later, he allegedly carried out a spoofing assault on the DraftKings web site, prosecutors stated. DraftKings staff have been capable of zero in on Garrison after launching their very own investigation and shopping for again a number of the stolen credentials he was promoting on the darkish net, prosecutors stated.
“Harrison gained unauthorized entry to the sufferer’s accounts by way of a complicated cyber assault to steal lots of of 1000’s of {dollars},” stated Michael Driscoll of the FBI. “Cyber intrusions geared toward stealing non-public people’ funds pose a severe risk to our financial safety.”
Investigators later decided that the IP tackle the thief used to promote the account data matched the tackle of Garrison’s mother and father’ dwelling, the place he lived.
