DraftKings hacker 'Snoopy' sentenced to 18 months in prison
DraftKings hacker 'Snoopy' sentenced to 18 months in prison for role in November 2022 cyberattack.
Nathan Austad, known as 'Snoopy', has been sentenced to 18 months in prison for his involvement in the November 2022 DraftKings cyberattack. He pleaded guilty to conspiracy to commit computer intrusion, admitting to compromising 60,000 accounts, adding payment methods to 1,600, and stealing $600,000. Austad also operated a shop selling access to these compromised accounts.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DraftKings?
Get an email when a new story names DraftKings, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe DraftKings breach was driven by credential stuffing — attackers like 'Snoopy' exploited users who reused passwords across multiple platforms, allowing mass account takeovers without exploiting any vulnerability in DraftKings' own systems. Over 60,000 accounts were compromised and 1,600 had fraudulent payment methods added before $600,000 was stolen. This case highlights the devastating financial and reputational consequences of weak account authentication controls and insufficient anomaly detection. The attacker then monetized the breach further by selling account access, amplifying harm well beyond the initial intrusion.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — credential stuffing