Posted on: November 16, 2023, 02:54h.
Last updated on: November 16, 2023, 02:54h.
A teenage hacker from Madison, Wis. has pleaded guilty to participating in a cyber intrusion scheme involving the theft of over $600K from approximately 1,600 DraftKings accounts.
Joseph Garrison, 18, is facing a sentence of up to five years in federal prison for his involvement in the cyber attack.
In November 2022, the cybercriminal launched a credential-stuffing attack on the sportsbook with a group of hackers, exploiting stolen credentials from corporate data breaches.
Garrison and his partners manipulated the accounts to add a new payment method, make a small deposit to verify the method, and withdraw the existing funds, according to court documents.
‘Addicted’ to Fraud
The fraud activity led to a 5% drop in DraftKings’ shares, triggering concerns among investors about consumer confidence in the mobile sportsbook. These shares were listed on the Nasdaq exchange.
When the FBI raided Garrison’s home, they seized credential-stuffing software and nearly 40 million pairs of stolen usernames and passwords from corporate websites found on the suspect’s computer.
Text message conversations from Garrison’s phone revealed discussions about hacking and exploiting the DraftKings website, court documents indicated.
In a message to a co-conspirator, Garrison expressed his “addiction” to fraudulent activities and how he was obsessed with making money through bypassing security measures, according to court records.
$15K Per Day
The investigation uncovered that Garrison had made over $2.1 million from cyber fraud by the time he turned 18, averaging $15k a day between 2018 and 2021.
Prior to the DraftKings incident, he had faced charges related to making bomb threats to his high school, Memorial High School in Madison, on multiple occasions.
Court documents noted that Garrison hired a third party to make these threats because he was “bored and wanted to go home.”