[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fulMnkFJ1ZPlrwuNBOMFDrgfFvQrsT9ew_NCGSATC4AY":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"021f62a2-24f8-47bb-af5c-355db61e2373","Minnesota man known as ‘Snoopy’ sentenced in DraftKings hack","minnesota-man-known-as-snoopy-sentenced-in-draftkings-hack-247f96","Nathan Austad, who sold access to compromised accounts through a criminal storefront, is the third and final defendant sentenced in the 2022 breach The post Minnesota man known as ‘Snoopy’ sentenced in DraftKings hack appeared first on CyberScoop.","Nathan Austad, a 21-year-old from Minnesota who operated under the alias 'Snoopy,' was sentenced to 18 months in federal prison for his role in a November 2022 credential stuffing attack that compromised approximately 60,000 DraftKings user accounts. The attackers stole roughly $600,000 directly from accounts and sold access to the remaining compromised accounts through cybercriminal marketplaces. Austad was ordered to pay over $1.3 million in restitution and forfeit $463,000 in cryptocurrency proceeds, and is the third and final defendant sentenced in the case.","Minnesota man 'Snoopy' sentenced to 18 months for role in 2022 DraftKings credential stuffing attack.","https:\u002F\u002Fcyberscoop.com\u002Fdraftkings-hack-sentencing-nathan-austad-snoopy\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F06\u002FGettyImages-1233655128.jpg","2026-06-25T14:19:23+00:00","2026-06-25T16:00:27.247562+00:00",7,[17,20,22,24,27],{"name":18,"type":19},"Nathan Austad (alias: Snoopy)","threat_actor",{"name":21,"type":19},"Joseph Garrison",{"name":23,"type":19},"Kamerin Stokes (alias: TheMFNPlug)",{"name":25,"type":26},"DraftKings","product",{"name":25,"type":28},"vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"malware","credential stuffing attack","Attack method used against DraftKings in November 2022",[25],{"controls":57,"vendors":139},[58,87,110],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":88,"name":89,"problem":90,"products":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[92,97,102],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":93,"product_name":94,"url":95,"description":96},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":98,"product_name":99,"url":100,"description":101},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":111,"name":112,"problem":113,"products":114},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":154},"credential-stuffing-attack-drains-60000-draftkings-accounts","Credential Stuffing Attack Drains 60,000 DraftKings Accounts","The DraftKings breach was driven by a credential stuffing attack, where attackers systematically tested large volumes of previously leaked username-and-password combinations against the platform's login system. The root cause was insufficient access control — specifically, the absence of robust multi-factor authentication (MFA) and rate limiting to block automated login attempts. This attack exposed ~60,000 users and resulted in $600,000 in direct theft, illustrating how password reuse across platforms can be weaponized at scale. It serves as a critical reminder that relying solely on passwords as an authentication mechanism is no longer acceptable for platforms holding financial assets.",[145,146,147,148,149,150,151,152,153],"NIST SP 800-63B (Digital Identity Guidelines – Authentication)","NIST AC-7 (Unsuccessful Logon Attempts)","NIST AC-2 (Account Management)","CIS Control 5 (Account Management)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","GDPR Article 32 (Security of Processing)","OWASP ASVS V2 (Authentication Verification Requirements)","PCI DSS Requirement 8 (Identify Users and Authenticate Access)",{}]