Loading story…
DraftKings, a major American sports betting and daily fantasy sports provider, experienced a credential stuffing attack that resulted in unauthorized access to some customer accounts. The attack was detected on September 2, 2025, when the company noticed suspicious login activity consistent with credential stuffing, a technique where attackers use stolen username and password pairs from previous breaches to gain access to user accounts on other platforms. DraftKings promptly launched an investigation and took steps to contain the incident, including notifying affected users and requiring password resets. The company emphasized that there was no evidence of a breach of its internal systems or networks, and that sensitive customer data such as government-issued identification numbers and full financial account numbers were not accessed. However, attackers may have viewed personal information including names, addresses, dates of birth, phone numbers, email addresses, the last four digits of payment cards, profile photos, transaction details, account balances, and the date the password was last changed. DraftKings stated that the login credentials used in the attack were not obtained from their own systems, but rather from external sources, highlighting the risks associated with password reuse across multiple online services. The company reassured customers that there was no indication of identity theft or unauthorized access to bank accounts as a result of this incident. In response, DraftKings required all potentially affected users to reset their passwords and strongly urged the adoption of multi-factor authentication (MFA) to enhance account security. The company also communicated transparently with its user base through data breach notification letters, outlining the nature of the attack and the steps being taken to protect customer information. DraftKings' swift response and containment measures were aimed at minimizing the impact of the attack and preventing further unauthorized access. The incident underscores the ongoing threat posed by credential stuffing attacks, particularly for organizations with large user bases and valuable personal data. DraftKings' experience serves as a reminder for all users to avoid reusing passwords and to enable MFA wherever possible. The company continues to monitor its systems for suspicious activity and is working to strengthen its security posture in light of this event. No evidence has emerged to suggest that the attackers were able to monetize the accessed information or that any widespread fraud has occurred. DraftKings' handling of the incident has been characterized by prompt action, clear communication, and a focus on user security. The attack highlights the importance of robust authentication practices and user education in defending against credential-based threats. DraftKings remains committed to safeguarding customer data and maintaining trust in its platform.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
After detecting the attacks, DraftKings notified affected users, warned that some accounts had been breached, and advised customers to reset passwords. The company also urged users to enable multi-factor authentication to better protect their accounts from reused-credential attacks.
DraftKings identified credential stuffing activity targeting customer accounts, in which attackers attempted logins using usernames and passwords exposed in breaches at other services. The activity led to unauthorized access to some accounts before the company moved to contain it.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by ProPublica and *The New York Times* raised concerns that DraftKings used behavioral data and machine-learning models to identify customers likely to increase their losses after receiving promotional offers. A model reportedly developed from 2023 assigned customers an “elasticity” score predicting the additional losses a promotion could generate; former employee Jayden Butts said its purpose was to maximize promotion return on investment. DraftKings denied unfairly targeting customers, saying promotions are based on engagement rather than losses. In a personal betting experiment, ProPublica reporter Jake Pearson reported receiving increasingly frequent promotions as his losses mounted and being invited to a VIP tryout after losing nearly $1,800 in one evening. Former employees also said DraftKings abandoned a proposed model that would have identified customers at risk of compulsive gambling or personal crisis, intensifying scrutiny of whether the company’s data practices adequately protect vulnerable users.
Oct 1, 2026
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Data breaches in the United States have reached alarming levels in 2025, with 835 incidents reported in the third quarter alone, affecting 23 million individuals. Despite a slight downturn in Q3, the total number of breaches for the year has already reached 2,563, impacting nearly 202 million victims, according to the Identity Theft Resource Center. The majority of these compromises—83%—were caused by cyberattacks, while physical attacks have also increased, with 53 incidents reported so far, surpassing the total for the previous year. Major organizations affected include Anne Arundel Dermatology, DaVita, Radiology Associates of Richmond, TransUnion, and Absolute Dental Group, each sending millions of breach notifications to affected individuals. The financial sector has been particularly hard hit, experiencing 188 breaches, making it the most impacted industry. A significant concern highlighted by the ITRC is that 71% of breach notifications lacked details about the attack vectors, which complicates efforts to mitigate identity theft and fraud. Microsoft’s 2025 Digital Defense Report corroborates the trend, noting a 32% surge in identity-based attacks in the first half of the year, with over 97% of these attacks leveraging stolen passwords. Hackers are increasingly using credential leaks, infostealer malware, and social engineering tactics such as help desk scams to obtain access to sensitive accounts. The Scattered Spider group has been linked to several high-profile attacks using these methods. Microsoft has also played a role in disrupting infostealer operations, notably taking down the Lumma Stealer infrastructure, though new variants continue to emerge. The prevalence of password-based attacks underscores the need for stronger authentication measures and better user education. The lack of transparency in breach notifications further exacerbates the risk, as individuals and organizations are left without critical information to protect themselves. The rise in both cyber and physical attacks demonstrates the evolving threat landscape facing US organizations. The healthcare and financial sectors remain prime targets due to the sensitive data they hold. Experts warn that unless organizations improve their security posture and reporting practices, the US is on track for another record-breaking year in data breaches. The combination of sophisticated attack techniques and inadequate breach disclosures increases the risk of widespread identity theft and financial fraud. Security professionals are urged to prioritize credential protection, implement multi-factor authentication, and ensure timely, detailed breach notifications to mitigate the growing threat.
Jun 29, 2026