30 Months Behind Bars for Selling Hacked DraftKings Accounts
A 23-year-old from Memphis has been sentenced to 30 months in prison for his role in selling access to tens of thousands of compromised **DraftKings** accounts. The accounts were initially hacked in a large-scale credential stuffing attack, highlighting the ongoing risks associated with password reuse and data breaches.
**Kamerin Stokes** of Memphis, Tennessee, received a 30-month prison sentence for selling access to a vast number of hacked **DraftKings** accounts.
The compromised accounts were the result of a November 2022 credential-stuffing attack orchestrated by **Nathan Austad** (aka Snoopy) and **Joseph Garrison**. Garrison was charged in May 2023 for his involvement. The attack compromised nearly 68,000 **DraftKings** accounts.
Prosecutors stated that Austad and Garrison exploited credentials stolen from various breaches to gain unauthorized access. They then sold access to these accounts, enabling others to steal approximately $635,000 from around 1,600 victims.
While Austad and Garrison profited over $2.1 million by selling hijacked **DraftKings**, **FanDuel**, and **Chick-fil-A** accounts through their own online shops, they also sold accounts in bulk to Stokes (known online as TheMFNPlug), who resold them through his own shop.
**DraftKings** had to refund hundreds of thousands of dollars stolen from the hacked accounts. The attackers were able to withdraw funds after adding a new payment method and making a small deposit to verify it.
After being arrested, pleading guilty, and being released pending trial, Stokes brazenly reopened his shop with a new tagline: "fraud is fun." He continued to sell access to compromised accounts for various retailers.
According to prosecutors, Stokes admitted to running these types of shops for three years. He relaunched his shop to earn money to pay his attorney.
"Kamerin Stokes victimized thousands of users of an online betting website though [sic] a cyberattack," stated U.S. Attorney **Jay Clayton**. "After pleading guilty to federal crimes, Stokes audaciously reopened his criminal business, marketed using the tagline 'fraud is fun,' and said that he opened the new Shop in part because 'gotta pay my attorneys,' referring to his prosecution in this case."
Stokes was rearrested for violating the conditions of his pretrial release after reopening his website.
In addition to the prison sentence, Stokes received three years of supervised release and was ordered to pay $1,327,061 in restitution and $125,965.53 in forfeiture.