Teen charged with hacking sports betting site DraftKings

Federal prosecutors on Thursday announced criminal charges against an 18-year-old Wisconsin man for a scheme to hack and sell access to user accounts of the sports betting site DraftKings.

The man, Joseph Garrison, is accused of working with others to steal about $600,000 from approximately 1,600 victim accounts during the November 2022 attack, according to the U.S. Attorney’s Office in Manhattan.

DraftKings is not named in the criminal complaint against Garrison. But a person close to the company confirmed it was a target of the so-called credential stuffing attack.

Law enforcement authorities searched Garrison’s home in Wisconsin on Feb. 23, and recovered his computer and cellphone, according to the complaint.

On those devices, investigators found credential stuffing programs, instruction photos on how to use stolen user credentials to steal money from victim accounts, and messages between Garrison and co-conspirators, the complaint said.

The messages included ones where Garrison wrote, “fraud is fun . . . im addicted to see money in my account . . . im like obsessed with bypassing s—” according to a court filing.

The images cited in the FBI affidavit were hosted on Imgur, a popular file-sharing website.

CNBC also found the same images on a website that purportedly sells compromised accounts on Draftkings and Fanduel, among others.

Garrison is charge charged with conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud, and aggravated identity theft.

He faces a maximum possible prison sentence of 20 years if convicted, but would likely get significantly less time under federal guidelines.

– Additional reporting by CNBC’s Rohan Goswami

This is breaking news. Please check back for updates.