✨ 2026 Futuriom 50: Highlights →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In November 2022, DraftKings, a prominent sports betting platform, experienced a credential-stuffing attack that compromised nearly 68,000 user accounts. Attackers utilized previously stolen credentials to gain unauthorized access, leading to the theft of approximately $635,000 from around 1,600 accounts. The perpetrators, including Nathan Austad and Joseph Garrison, sold access to these accounts, with accomplice Kamerin Stokes reselling them through his own platform. Stokes, known online as 'TheMFNPlug,' continued his illicit activities even after initial legal actions, reopening his shop with the tagline 'fraud is fun.'

This incident underscores the persistent threat of credential-stuffing attacks, especially in industries handling sensitive financial information. The case highlights the importance of robust cybersecurity measures and the need for users to employ unique, strong passwords across different platforms to mitigate such risks.

Why This Matters Now

The sentencing of individuals involved in the DraftKings credential-stuffing attack serves as a critical reminder of the ongoing vulnerabilities in online platforms. As cybercriminals continue to exploit reused credentials, organizations must prioritize implementing advanced security protocols, and users should adopt stringent password practices to safeguard against such breaches.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Credential stuffing is a cyberattack method where attackers use stolen username-password pairs from previous breaches to gain unauthorized access to user accounts on different platforms.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attackers' ability to exploit compromised credentials and perform unauthorized actions within the cloud environment. By implementing identity-aware controls and dynamic segmentation, CNSF would likely have limited the attackers' lateral movement and reduced the overall blast radius of the breach.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The attackers' ability to exploit compromised credentials would likely have been constrained, reducing unauthorized access to cloud resources.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The attackers' ability to escalate privileges by modifying account settings would likely have been constrained, limiting unauthorized changes.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The attackers' ability to move laterally and exploit linked financial instruments would likely have been constrained, reducing unauthorized financial activities.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The attackers' ability to maintain persistent access would likely have been constrained, limiting their control over compromised accounts.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The attackers' ability to exfiltrate funds would likely have been constrained, reducing unauthorized financial withdrawals.

Impact (Mitigations)

The financial impact of the breach would likely have been reduced, limiting the extent of monetary losses.

Impact at a Glance

Affected Business Functions

  • User Account Management
  • Financial Transactions
  • Customer Support
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $635,000

Data Exposure

Personal information of approximately 68,000 customers, including names, addresses, phone numbers, email addresses, and partial payment card details.

Recommended Actions

  • • Implement multi-factor authentication (MFA) across all user accounts to prevent unauthorized access.
  • • Enforce strong, unique password policies and educate users on the risks of credential reuse.
  • • Deploy anomaly detection systems to identify and respond to unusual account activities promptly.
  • • Utilize zero trust segmentation to limit lateral movement within the network.
  • • Establish robust egress security and policy enforcement to monitor and control outbound traffic.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image