Loading story…
Nathan Austad, a 21-year-old Minnesota man who used the alias "Snoopy", was sentenced to 18 months in prison for his role in the 2022 credential-stuffing attack that compromised DraftKings customer accounts. U.S. prosecutors said Austad pleaded guilty to conspiracy to commit computer intrusion and admitted participating in a scheme that used usernames and passwords from other breaches to access DraftKings accounts protected by weak or reused credentials. He was also sentenced to three years of supervised release and ordered to pay roughly $1.8 million in restitution and forfeiture.
Authorities said the group compromised about 60,000 accounts, while DraftKings previously disclosed that 67,995 customer accounts were affected. The attackers added payment methods they controlled to roughly 1,600 accounts, stole about $600,000, and sold access to compromised accounts through online marketplaces including Goat Shop and Austad’s own Snoopy-branded site. Investigators also traced about $465,000 in cryptocurrency tied to Austad, and his sentencing makes him the third defendant convicted in the case after Joseph Garrison and Kamerin Stokes received prison terms.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Kamerin Stokes, also known as “TheMFNPlug,” was sentenced in April to 30 months in prison for his role in the 2022 DraftKings hacking case. The sentencing made him one of the defendants punished in connection with the credential-stuffing scheme against DraftKings accounts.
The U.S. Department of Justice announced that Nathan Austad was sentenced to 18 months in prison for his role in the 2022 DraftKings credential-stuffing attack. He was also ordered to serve three years of supervised release and pay restitution and forfeiture totaling roughly $1.8 million.
U.S. authorities charged Joseph Garrison in May 2023 for his role in the DraftKings account hacking campaign. He was one of the defendants tied to the credential-stuffing operation.
In December 2025, Nathan Austad pleaded guilty to conspiracy to commit computer intrusion in connection with the DraftKings hacking campaign. He admitted participating in the compromise of 60,000 DraftKings accounts.
In January 2024, U.S. authorities charged Nathan Austad and Kamerin Stokes for their alleged roles in the DraftKings credential-stuffing scheme. Prosecutors linked them to the theft of funds and the sale of access to hacked accounts.
In November 2022, attackers used usernames and passwords from other breaches to compromise DraftKings accounts through credential stuffing. The scheme affected tens of thousands of accounts, with criminals stealing funds from about 1,600 accounts and selling access to compromised accounts online.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Attorney’s Office for the Southern District of New York said Kamerin Stokes, also known as **"TheMFNPlug,"** was sentenced to 30 months in prison for his role in a credential stuffing scheme that compromised user accounts at a fantasy sports and betting platform identified in news coverage as DraftKings. Prosecutors said the attack began around November 18, 2022, using stolen credentials from other breaches to gain access to about **60,000 accounts**, enabling theft from customer balances and causing losses of hundreds of thousands of dollars. Authorities said Stokes bought compromised betting accounts in bulk and operated an online **"Shop"** that sold access to stolen accounts, with victim accounts listed at more than **$125,000** in total value. After pleading guilty on April 25, 2024, to conspiracy to commit computer intrusion, he allegedly reopened the shop, promoted it with the slogan **"fraud is fun,"** and said he did so in part to pay his attorneys, leading to his rearrest for violating pretrial release conditions. In addition to prison, the court imposed **three years of supervised release**, **forfeiture of $125,965.53**, and **restitution of $1,327,061**.
Jun 29, 2026
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026
Albert Gonzalez, known online as **`SoupNazi`**, was sentenced to 20 years in prison for leading a hacking ring behind some of the largest payment card breaches prosecuted in the United States. U.S. authorities said Gonzalez and his co-conspirators infiltrated major retailers and payment processors including **TJX, BJ’s Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority, Dave & Buster’s, 7-Eleven, Hannaford Brothers,** and **Heartland Payment Systems**, stealing tens of millions of credit and debit card numbers and causing losses estimated at nearly **$200 million**, with broader economic damage potentially reaching into the billions. Court records said the group used **wardriving** to find vulnerable wireless networks, deployed sniffers and Trojan malware to capture payment card data, and moved stolen information through anonymous online currencies and bank accounts in Eastern Europe. The Justice Department described the operation as the largest hacking and identity theft ring then prosecuted by the U.S. government, involving accomplices in the United States, Estonia, Ukraine, and Turkey, affecting more than **250 financial institutions**, and resulting in multiple guilty pleas, extraditions, and related convictions tied to the sale and fraudulent use of more than **40 million** stolen card numbers.
Jul 22, 2026