Loading story…
Investigations by ProPublica and The New York Times raised concerns that DraftKings used behavioral data and machine-learning models to identify customers likely to increase their losses after receiving promotional offers. A model reportedly developed from 2023 assigned customers an “elasticity” score predicting the additional losses a promotion could generate; former employee Jayden Butts said its purpose was to maximize promotion return on investment. DraftKings denied unfairly targeting customers, saying promotions are based on engagement rather than losses.
In a personal betting experiment, ProPublica reporter Jake Pearson reported receiving increasingly frequent promotions as his losses mounted and being invited to a VIP tryout after losing nearly $1,800 in one evening. Former employees also said DraftKings abandoned a proposed model that would have identified customers at risk of compulsive gambling or personal crisis, intensifying scrutiny of whether the company’s data practices adequately protect vulnerable users.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The New York Times reported that DraftKings used a machine-learning system that assigned customers an “elasticity” score to estimate whether promotions would lead them to gamble and lose more. The investigation drew on interviews with more than 40 former employees and internal company material.
Former insiders said DraftKings began developing a newer machine-learning model that used customer behavioral data to predict which users would lose more after receiving promotional offers.
DraftKings denied targeting users unfairly, saying that its promotions reward engagement rather than customer losses.
During a personal betting experiment, ProPublica journalist Jake Pearson received increasing promotional offers as his losses rose. After losing nearly $1,800 on basketball in one evening, he was invited to a VIP tryout and later received full VIP membership.
DraftKings reportedly canceled a demonstration and shut down a proposed model designed to identify customers whose behavior indicated compulsive gambling or crisis risk. Former data scientists said the model had shown promise, while subsequent attempts to develop similar systems failed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DraftKings, a major American sports betting and daily fantasy sports provider, experienced a credential stuffing attack that resulted in unauthorized access to some customer accounts. The attack was detected on September 2, 2025, when the company noticed suspicious login activity consistent with credential stuffing, a technique where attackers use stolen username and password pairs from previous breaches to gain access to user accounts on other platforms. DraftKings promptly launched an investigation and took steps to contain the incident, including notifying affected users and requiring password resets. The company emphasized that there was no evidence of a breach of its internal systems or networks, and that sensitive customer data such as government-issued identification numbers and full financial account numbers were not accessed. However, attackers may have viewed personal information including names, addresses, dates of birth, phone numbers, email addresses, the last four digits of payment cards, profile photos, transaction details, account balances, and the date the password was last changed. DraftKings stated that the login credentials used in the attack were not obtained from their own systems, but rather from external sources, highlighting the risks associated with password reuse across multiple online services. The company reassured customers that there was no indication of identity theft or unauthorized access to bank accounts as a result of this incident. In response, DraftKings required all potentially affected users to reset their passwords and strongly urged the adoption of multi-factor authentication (MFA) to enhance account security. The company also communicated transparently with its user base through data breach notification letters, outlining the nature of the attack and the steps being taken to protect customer information. DraftKings' swift response and containment measures were aimed at minimizing the impact of the attack and preventing further unauthorized access. The incident underscores the ongoing threat posed by credential stuffing attacks, particularly for organizations with large user bases and valuable personal data. DraftKings' experience serves as a reminder for all users to avoid reusing passwords and to enable MFA wherever possible. The company continues to monitor its systems for suspicious activity and is working to strengthen its security posture in light of this event. No evidence has emerged to suggest that the attackers were able to monetize the accessed information or that any widespread fraud has occurred. DraftKings' handling of the incident has been characterized by prompt action, clear communication, and a focus on user security. The attack highlights the importance of robust authentication practices and user education in defending against credential-based threats. DraftKings remains committed to safeguarding customer data and maintaining trust in its platform.
Jul 12, 2026
A Lawfare analysis identifies **replacement through knowledge acquisition (RKA)** as an enterprise risk in which frontier AI providers derive valuable knowledge from customer prompts, uploaded files, outputs, metadata, and usage patterns, then use it to develop products that compete with those customers. The concern spans software, legal services, financial services, and potentially manufacturing, particularly as AI platforms expand across large business customer bases. The analysis warns that data acquisition could occur openly through permissive contracts or more subtly through retained enterprise data, continual learning from transient interactions, and commercial pressure to accept broad sharing terms. It argues that existing contracts, trade-secret protections, and U.S. antitrust law may not adequately prevent such misuse, and recommends stronger transparency and audit requirements, safeguards for contractual information sharing, duties restricting customer-data misuse, and statutory damages.
Aug 26, 2026
Kentucky Attorney General Russell Coleman sued **Character.AI** and its founders under the state’s new Consumer Data Protection Act, alleging the chatbot service obscured key details about data collection (including use of children’s data to improve its large language model) and failed to implement effective **age restrictions** and **parental controls**. The complaint also argues the product’s design and safeguards are insufficient to prevent minors from disclosing sensitive personal information and from being exposed to harmful interactions. In the UK, **Ofcom** opened a formal investigation into **X** to assess whether the platform is meeting obligations under the **Online Safety Act** after users leveraged the integrated **Grok** chatbot to generate and spread **nonconsensual AI-manipulated sexual images**, including content involving children. Separately, the *Poison Fountain* initiative is encouraging website operators to deliberately **poison AI training data** by embedding links that route crawlers to corrupted or subtly incorrect content (including flawed code), reflecting a growing—controversial—trend toward using data-poisoning tactics to degrade model performance and push back against large-scale web scraping for AI training.
Jun 29, 2026