DraftKings Credential-Stuffing Hacker Sentenced to 30 Months in Prison

Summary

Kamerin Stokes was sentenced to 30 months in prison for his role in a 2022 credential-stuffing scheme that accessed about 60,000 DraftKings accounts; he also faces forfeiture and restitution.

Key points

• Attackers used username-password combinations from other breaches to access about 60,000 accounts, with the goal of withdrawing funds.
• Stokes, who used the online moniker “TheMFNPlug,” acquired DraftKings accounts in bulk and sold access through an online marketplace.
• He received 30 months in prison and three years of supervised release, and was ordered to pay $125,000 in forfeiture and $1.3 million in restitution.
• The article identifies DraftKings as the target, while noting that the Justice Department described the site only as a fantasy sports and betting website.
• The Justice Department said Stokes reopened his marketplace after pleading guilty and offered access to accounts at various retailers.
• Joseph Garrison pleaded guilty and was sentenced to 18 months; Nathan Austad pleaded guilty and was awaiting sentencing, according to the article.
• DraftKings was still facing credential-stuffing attacks and warned users in October 2025.

MITRE ATT&CK

Threat Actors

Products