Sports betting firm DraftKings says the personal data of 68,000 individuals has been compromised in a recent data breach.
The incident, initially disclosed in November, was the result of a credential stuffing attack and not a breach of DraftKings’ systems, the company says.
Credential stuffing involves the use of leaked credentials (usernames, email addresses, and passwords) obtained from a third-party source to access an account on a different service. Such attacks are successful only because some individuals use the same credentials for accounts on different services.
DraftKings also announced at the time that the attackers withdrew roughly $300,000 from some of the compromised accounts, and that it would restore all the stolen funds.
On Friday, the company started sending out notification letters to the impacted customers, to inform them that some of their personal information might have been compromised during the incident, reiterating that the attackers used leaked credentials to access the accounts.
“Based on our investigation to date, we believe that attackers may have previously gained access to your username or email address and password from a non-DraftKings source and then used those credentials to access your DraftKings account,” a notification letter sent to impacted customers reads.
DraftKings says that personal information potentially compromised in the attack may include names, addresses, phone numbers, email addresses, profile photos, account balance, the last four digits of a payment card, details about prior transactions, and the date of the last password change.
The company also notes that it has no evidence that Social Security numbers, driver’s license numbers, or financial account numbers were compromised in the attack and underlines that it does not store full payment card numbers, card expiration dates, or CVVs.
Immediately after identifying the incident, the company prompted the impacted customers to reset their accounts’ passwords and is now urging them once again to reset their passwords and to review their account and credit reports to identify any suspicious activity.
“We have restored amounts that have been withdrawn from certain accounts in connection with credential stuffing attacks, as determined and identified by DraftKings,” the company says.
DraftKings informed the Maine Attorney General that a total of 67,995 individuals were impacted in the data breach.
Related: Personal Information of 123K Individuals Exposed in City of Tucson Data Breach
Related: California County Says Personal Information Compromised in Data Breach
Related: Data Breach at Shields Health Care Group Impacts 2 Million Patients
