DraftKings warns of account breaches in credential stuffing attacks

DraftKings notified customers that a credential-stuffing campaign allowed attackers to access a small number of accounts and view limited personal data (name, address, DOB, phone, email, profile photo, last four card digits, transaction info). The company said its systems were not breached, sensitive financial or government ID data were not accessed, required password resets and MFA for affected users, and later reported the incident impacted fewer than 30 customers with no reported financial loss.