18-year-old Joseph Harrison of Madison (Wisconsin) is accused of organizing a hacking site of DRAFTKINGS SPORT and stole 600 thousand dollars from hundreds of customer accounts.
According to federal prosecutors in Manhattan, Harrison used stolen logins and passwords that he bought in a darknet to hack 60 thousand accounts on Draftkin in November last year. Then he sold this information to other people who used it to devote 1,600 customer accounts. This hacking method is called “Credential Stuffing” and works best when users use the same password and login on different sites.
“Fraud is fun,” Harrison allegedly wrote in a text message to his accomplice, according to the documents of the court. “I am dependent on seeing money on my account.”
DRAFTKINGS is not named in a criminal lawsuit, but confirmed that some accounts of its customers were compromised during the scheme and stated that she returned the stolen money.
“The safety and confidentiality of the personal and payment information of our customers are of paramount importance for DraftKins,” the company said.
During the hacking, Harrison was already encountering accusations in a separate case of Wisconsin for allegedly paid people in bitcoins online for calling the bomb threats to his own school in Madison and in other cities where his friends lived . This practice is called “Swatting”. In one of these cases, Harrison allegedly asked to call with a threat because he was bored and he wanted to go home according to court recordings in Wisconsin.
Harrison surrendered to the New York authorities on Thursday morning and was supposed to appear before the judge later on the same day. It was not immediately clear whether he hired a lawyer in the case of a hacking, and the lawyer who presented him in the previously case of Swatting did not respond to the message with a request to comment on the arrest.
While the Wisconsin police investigated the case of Swatting, she found evidence that Harrison was involved in a series of hacker scams for several years and accumulated a fortune of $ 2.1 million by 17 years. He admitted that he earned an average of 15 thousand dollars a day from 2018 to 2021, but told the investigators that he stopped engaged in any hacker activity, the court documents said.
But five months after that, he allegedly attacked the “Credential Stuffing” on the Draftkings website, the prosecutors said. DRAFTKINS employees were able to go on the trail of Harrison after launched their own investigation and bought some of the accounts he had stolen, which he sold in a dark network.
“Harrison gained unauthorized access to the victims of the victims, using a complex cyberatak for theft of hundreds of thousands of dollars,” said Michael Driscoll from the FBI. “Cyber surroundings aimed at theft of personal funds of private individuals pose a serious threat to our economic security.”