Minnesota man known as ‘Snoopy’ sentenced in DraftKings hack
Minnesota man 'Snoopy' sentenced to 18 months for role in 2022 DraftKings credential stuffing attack.
Nathan Austad, a 21-year-old from Minnesota who operated under the alias 'Snoopy,' was sentenced to 18 months in federal prison for his role in a November 2022 credential stuffing attack that compromised approximately 60,000 DraftKings user accounts. The attackers stole roughly $600,000 directly from accounts and sold access to the remaining compromised accounts through cybercriminal marketplaces. Austad was ordered to pay over $1.3 million in restitution and forfeit $463,000 in cryptocurrency proceeds, and is the third and final defendant sentenced in the case.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DraftKings?
Get an email when a new story names DraftKings, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe DraftKings breach was driven by a credential stuffing attack, where attackers systematically tested large volumes of previously leaked username-and-password combinations against the platform's login system. The root cause was insufficient access control — specifically, the absence of robust multi-factor authentication (MFA) and rate limiting to block automated login attempts. This attack exposed ~60,000 users and resulted in $600,000 in direct theft, illustrating how password reuse across platforms can be weaponized at scale. It serves as a critical reminder that relying solely on passwords as an authentication mechanism is no longer acceptable for platforms holding financial assets.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — credential stuffing attack