[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQQ0wuDLFULnNLOw5QCESbPrLqqVK7AgciDSQjeav-bM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"9ff2b18b-a65f-4cd7-8ebd-89bcfcdf6ae9","credential-stuffing-attack-drains-60000-draftkings-accounts","021f62a2-24f8-47bb-af5c-355db61e2373","Credential Stuffing Attack Drains 60,000 DraftKings Accounts","The DraftKings breach was driven by a credential stuffing attack, where attackers systematically tested large volumes of previously leaked username-and-password combinations against the platform's login system. The root cause was insufficient access control — specifically, the absence of robust multi-factor authentication (MFA) and rate limiting to block automated login attempts. This attack exposed ~60,000 users and resulted in $600,000 in direct theft, illustrating how password reuse across platforms can be weaponized at scale. It serves as a critical reminder that relying solely on passwords as an authentication mechanism is no longer acceptable for platforms holding financial assets.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) for all user accounts, especially those tied to financial transactions.\n- Implement aggressive rate limiting and CAPTCHA challenges on login endpoints to block automated credential stuffing tools.\n\n**Long-term improvements:**\n- Integrate with breach-credential intelligence feeds (e.g., Have I Been Pwned API) to proactively flag accounts using compromised passwords.\n- Adopt a passwordless or phishing-resistant authentication standard (e.g., FIDO2\u002FWebAuthn) to eliminate password reuse risk entirely.\n- Conduct regular threat modeling exercises focused on account takeover attack vectors.\n\n**Detection measures:**\n- Deploy behavioral analytics and anomaly detection to flag unusual login velocity, geographic anomalies, or rapid sequential account access.\n- Establish real-time alerting for bulk failed login attempts and automatically lock or challenge suspicious sessions.\n- Maintain detailed authentication logs with sufficient retention to support forensic investigation and regulatory reporting.",[12,13,14,15,16,17,18,19,20],"NIST SP 800-63B (Digital Identity Guidelines – Authentication)","NIST AC-7 (Unsuccessful Logon Attempts)","NIST AC-2 (Account Management)","CIS Control 5 (Account Management)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","GDPR Article 32 (Security of Processing)","OWASP ASVS V2 (Authentication Verification Requirements)","PCI DSS Requirement 8 (Identify Users and Authenticate Access)",{},"published","2026-06-25T16:20:51.308173+00:00","2026-06-25T16:20:51.152+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fcyberscoop.com\u002Fdraftkings-hack-sentencing-nathan-austad-snoopy\u002F","minnesota-man-known-as-snoopy-sentenced-in-draftkings-hack-247f96","Minnesota man known as ‘Snoopy’ sentenced in DraftKings hack",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[44,48,52],{"slug":45,"name":46,"problem":47},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":49,"name":50,"problem":51},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":53,"name":54,"problem":55},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]