Man Sentenced to 30 Months for Selling Hacked DraftKings Accounts
Summary
Kamerin Stokes was sentenced to 30 months for reselling access to hijacked DraftKings accounts. Prosecutors linked the accounts to a November 2022 credential-stuffing campaign that compromised nearly 68,000 accounts.
Key points
- Stokes, who pleaded guilty, sold access to tens of thousands of compromised DraftKings accounts.
- Court documents linked the accounts to a November 2022 credential-stuffing attack using credentials stolen in multiple breaches.
- The campaign compromised nearly 68,000 DraftKings accounts; prosecutors said about $635,000 was stolen from roughly 1,600 accounts.
- Austad and Garrison reportedly made more than $2.1 million selling accounts, including DraftKings, FanDuel and Chick-fil-A accounts; Stokes bought some in bulk and resold them.
- After pleading guilty, Stokes reopened his shop and continued selling account access; he was later arrested for violating pretrial release.
- Stokes was ordered to pay $1,327,061 in restitution and $125,965.53 in forfeiture, and received three years of supervised release.
Article Details
- Event Type
- Sentencing for selling access to accounts compromised in a credential-stuffing attack
- Impact
- The November 2022 attack compromised nearly 68,000 DraftKings accounts. Prosecutors said about $635,000 was stolen from roughly 1,600 accounts and more than $2.1 million was earned selling compromised accounts. Kamerin Stokes was sentenced to 30 months in prison and three years of supervised release, and ordered to pay $1,327,061 in restitution and $125,965.53 in forfeiture.
MITRE ATT&CK
People
Threat Actors
Joseph GarrisonThe article says Garrison helped with the November 2022 credential-stuffing attack; it also reports that he was charged in May 2023.Kamerin StokesStokes sold access to compromised DraftKings accounts and, after pleading guilty, reopened his shop and continued selling access to compromised accounts.Nathan AustadThe article links Austad to the November 2022 credential-stuffing attack that compromised nearly 68,000 DraftKings accounts.