A teenager was charged by Federal prosecutors yesterday for his alleged participation in a hacking scheme against the fantasy sports contest and betting site DraftKings. Joseph Garrison, an 18-year-old resident of Madison, Wisconsin, was charged with six counts of wire fraud, hacking, and identity theft. The complaint was filed in the Southern District of New York earlier this week. The young man allegedly participated in a scheme that involved stealing the login credentials of 60,000 DraftKings customers and selling them on the dark web. The passwords and usernames of the punters were then used to gain unauthorized access to their accounts for the purpose of stealing funds from their balance.
After obtaining the sensitive information, the teen sold it on different websites specializing in the marketing and sale of illegal account credentials. The fraudsters who subsequently purchased the passwords and usernames used them to hack 1,600 sports betting accounts and managed to extract $600,000 from their balance. News channel CNBC uncovered that DraftKings was the subject of the hacking attack, although the company was not specifically named in the complaint.
Garrison’s arrest came after the sports betting company detected an increase in what it referred to as ‘irregular activity’ on its website. Undercover agents purchased some of the stolen passwords and usernames along with detailed instructions on how to use them. The agents also established the IP address used to sell the sensitive information was connected to the 18-year-old Madison resident and more specifically, to his parents’ house. DraftKings subsequently refunded the money of some of the defrauded customers.
Police Officials Found 40 Million Stolen Login Credentials on Garrison’s Computer
Following his detainment, police officers searched the apartment of the Wisconsinite in February and seized his mobile phone and laptop. On these devices, they uncovered evidence that suggested the youngster resorted to credential stuffing software to steal sensitive data. The devices also contained information on how to gain unauthorized access to user accounts. The officers found approximately 40 million login credentials on the young man’s laptop.
Various chats where the teen bragged about his involvement in different types of fraud were also uncovered, according to the complaint. In some of the messages, Garrison told an anonymous co-conspirator that he considered fraud ‘fun’ and described himself as ‘addicted’ to seeing money pour into his account.
The complaint filed against the Wisconsinite also contained information suggesting that the 18-year-old admitted to hacking accounts in June of last year. The young man sold the stolen information on a website called Goat Shop, which he allegedly operated. Garrison shared with police officers at the time that he racked up as much as $15,000 per day from selling stolen data on Goat Shop. His cumulative profits from the criminal venture reportedly amounted to a whopping $800,000 between 2018 and 2021.
The young Madison resident is now being prosecuted by the Complex Frauds and Cybercrime Unit of the Southern District of New York. He faces charges on six criminal counts, including conspiring to commit computer intrusions, aggravated identity theft, wire fraud, conspiring to commit wire fraud, and hacking a protected computer network. Each of the wire fraud charges carries a maximum sentence term of 20 years behind bars, while the three hacking charges are associated with a five-year imprisonment sentence each. Identity theft has a minimum sentence of two-year imprisonment.
