DraftKings, a popular daily fantasy sports operator, revealed last week that several of its user accounts had been hijacked due to suspicious activity on third-party websites. Over a short period of time, the internet hacking activity led in the illicit removal of hundreds of thousands of dollars in consumer monies. On Tuesday, the popular sports betting provider attempted to alleviate the repercussions.
At 10:11 p.m. CST Sunday, one of the impacted customers got a notice from DraftKings authorizing the $437 withdrawal request to send the cash to a Houston address. The consumer said that the request must be bogus because he lives nowhere near Houston. Another client from Kansas City, Missouri, said that $19,439,00 went missing from his DraftKings account at 8:30 p.m. CST on Sunday night, only to be recovered 40 minutes later.
In a statement, DraftKings co-founder Paul Liberman stated that the theft affected around $300,000 in consumer payments and emphasized that the operator will compensate every customer that was affected. Lieberman said:
“We currently believe that the login information of these customers was compromised on other websites and then used to access their DraftKings accounts where they used the same login information.”
Lieberman stressed that the hack did not include infiltration of its systems and no sensitive information got captured. Although it is not unclear who is behind the hack, it is evident that the hackers used a technique called ‘credential stuffing’. This capitalizes on the fact that most people reuse their passwords on multiple sites. When fraudsters receive hacked credentials, they will put them through their paces on new websites. As a result, Lieberman highlighted the importance of strong password protection for their accounts by saying:
“We strongly encourage customers to use unique passwords for DraftKings and all other sites, and we strongly recommend that customers do not share their passwords with anyone, including third party sites for the purposes of tracking betting information on DraftKings and other betting apps.”
As of today Thursday, December 1, all affected customers have been reimbursed.