DraftKings reveals details of "credential stuffing attack"
DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach after an incident, initially disclosed in November, was the result of a "credential stuffing attack" and not a breach of DraftKings’ systems.
From SecurityWeek.com:
Quote:
Credential stuffing involves the use of leaked credentials (usernames, email addresses, and passwords) obtained from a third-party source to access an account on a different service. Such attacks are successful only because some individuals use the same credentials for accounts on different services.
DraftKings also announced at the time that the attackers withdrew roughly $300,000 from some of the compromised accounts, and that it would restore all the stolen funds.
On Friday, the company started sending out notification letters to the impacted customers, to inform them that some of their personal information might have been compromised during the incident, reiterating that the attackers used leaked credentials to access the accounts.
“Based on our investigation to date, we believe that attackers may have previously gained access to your username or email address and password from a non-DraftKings source and then used those credentials to access your DraftKings account,” a notification letter sent to impacted customers reads.
DraftKings says that personal information potentially compromised in the attack may include names, addresses, phone numbers, email addresses, profile photos, account balance, the last four digits of a payment card, details about prior transactions, and the date of the last password change.
Read more here: https://www.securityweek.com/draftki...8000-customers
