DraftKings credential stuffing shows why MFA alone is not enough

At a glance

What this is: This is an analysis of the DraftKings credential stuffing account breach and its key lesson: reused credentials plus automation can still drive account takeover despite basic authentication controls.

Why it matters: It matters to IAM practitioners because the same failure pattern affects consumer identity, fraud controls, and adjacent account protection programmes whenever password reuse and weak detection remain in place.

By the numbers:

• Attackers attempted access within an average of 17 minutes when AWS credentials are exposed publicly, and as quickly as 9 minutes in some cases.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, including 46% confirmed cases and 26% suspected cases.

👉 Read FireCompass's analysis of the DraftKings credential stuffing breach

Context

Credential stuffing is an account takeover technique that tests stolen username and password pairs at scale until one works. In this case, the primary identity control failure was not infrastructure compromise but weak resistance to credential reuse and insufficient detection of abnormal login behaviour in a consumer IAM environment.

For IAM teams, the DraftKings breach is a reminder that authentication controls are only part of the story. If reused credentials are still valid, if login velocity is not constrained, and if account activity is not monitored for anomalies, attackers can access customer data without touching backend systems.

Key questions

Q: What breaks when credential stuffing is not blocked at the login layer?

A: The login plane becomes a low-cost test bed for stolen credentials, and one valid reuse can turn into account takeover. When rate limits, anomaly detection, and lockout handling are weak, attackers can move from repeated failures to successful access without exploiting the application itself.

Q: Why does credential stuffing create fraud risk even when payment data is only partially exposed?

A: Partial exposure is often enough to support social engineering, account recovery abuse, and targeted fraud. Names, addresses, transaction history, and last-four payment digits can help attackers verify identity, pass support checks, and stage more convincing downstream attacks.

Q: How can security teams tell credential stuffing from ordinary user login failures?

A: Look for rapid sequential attempts, unusual IP diversity, user-agent anomalies, account lockouts followed by success, and failure bursts across many accounts. Ordinary user mistakes are usually slower and more localized, while credential stuffing has a distributed automated pattern.

Q: Should organisations prioritise MFA or login anomaly detection first?

A: They should do both, but detection and throttling often need immediate attention when reused passwords are already in circulation. MFA reduces exposure, yet it does not stop password reuse patterns or give early warning when attackers are testing many accounts at once.

Technical breakdown

Credential stuffing as an authentication abuse pattern

Credential stuffing relies on previously exposed username and password combinations, then automates login attempts across many accounts until a subset succeeds. It differs from password guessing because the inputs are real credentials harvested elsewhere, which makes traditional password complexity alone ineffective. The attacker’s advantage comes from scale, speed, and credential reuse, not from deep exploitation of the target environment. In this case, the logs showed rapid sequential attempts, failed authentication spikes, and then successful logins, which is the classic footprint of account takeover activity.

Practical implication: monitor for bursty authentication patterns, not just invalid password volume.

Why MFA helps but does not close the takeover window

Multi-factor authentication reduces the value of stolen passwords, but it is not a complete answer when accounts already lack strong behavioural controls or when users have weak recovery flows. In credential stuffing scenarios, attackers often target accounts before MFA is universally enabled, or they pivot to sessions and recovery paths that preserve access. MFA also does not address password reuse, which is the upstream weakness that makes credential stuffing viable in the first place. The control works best as one layer in a broader account protection model, not as a standalone solution.

Practical implication: pair MFA with rate limiting, risk-based challenges, and password reuse detection.

Login telemetry that distinguishes noise from takeover

The most useful signals in credential stuffing are not raw login failures but the sequence and shape of those failures. Repeated attempts from suspicious IP addresses, user-agent inconsistencies, account lockouts followed by success, and impossible login cadence together indicate automation rather than ordinary user error. Windows event pairs such as failed logons followed by successful logons can help, but consumer IAM telemetry often needs application-layer correlation to spot distributed attack tools. Without that correlation, the attack can look like routine password reset churn or normal user friction.

Practical implication: correlate authentication logs with IP reputation, device signals, and velocity thresholds.

Threat narrative

Attacker objective: The attacker objective was account takeover for access to customer data and potentially monetisable identity and payment-related information.

1. Entry occurred through credential stuffing, where attackers used stolen username and password pairs from other breaches to attempt logins at scale.
2. Escalation happened when automated trials found valid credentials and the attackers gained authenticated access to customer accounts without malware or system exploitation.
3. Impact followed in the form of exposure to personal details, transaction history, partial payment data, and account state information across compromised accounts.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential stuffing is an identity governance failure before it is a login problem. The breach worked because reused credentials remained valid enough to be weaponised at scale, and because account controls were not sufficiently tuned to detect automation. That is a consumer IAM weakness, but it also matters to any programme that still treats authentication as a binary success or failure event rather than an access risk signal.

Account takeover controls fail when they are designed around user error instead of adversarial automation. Credential stuffing creates many low-signal attempts, then one high-value success, which means rate limiting, velocity checks, and anomaly detection must work together. Practitioners should treat the login plane as an attack surface, not just an authentication service.

Standing trust in reused credentials is the named concept this breach exposes. Once passwords are repeated across services, the control boundary moves outside the organisation and into breach ecosystems the IAM team does not govern. The implication is that security teams must stop assuming passwords are a controllable enterprise asset once they are reused elsewhere.

This breach reinforces that consumer identity and fraud monitoring now overlap operationally. The personal data exposed here, including transaction history and partial payment details, gives fraud actors enough context to refine social engineering and future takeover attempts. Identity teams should coordinate with fraud, customer protection, and SOC functions instead of treating them as separate workstreams.

Credential stuffing remains persistent because the upstream credential economy is persistent. Attackers do not need novel exploitation when reused credentials, distributed automation, and weak behavioral telemetry remain available. The practical conclusion is that governance must account for credential reuse beyond the boundary of the local application.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: See Ultimate Guide to NHIs , Key Challenges and Risks for the visibility and over-privilege patterns that turn identity gaps into incidents.

What this signals

Standing trust in reused credentials is now the more useful way to frame credential stuffing, because the attack succeeds when identities remain portable across breach ecosystems. That should push IAM teams to think in terms of exposure reduction, not just authentication success rates, and to anchor their programme to OWASP Non-Human Identity Top 10 where identity reuse and lifecycle control intersect with the broader login surface.

Consumer IAM teams should expect more overlap with fraud operations as attackers use account history, profile data, and recovery paths to extend initial access into monetisable abuse. The practical signal is that login monitoring, customer support, and fraud triage can no longer sit in separate queues when identity abuse is the entry point.

Credential reuse also has a machine-identity analogue in NHI environments, where a single exposed secret can be replayed at scale. When non-human identities are poorly governed, the blast radius resembles consumer account takeover more than a conventional perimeter breach, which is why Ultimate Guide to NHIs , Static vs Dynamic Secrets remains relevant beyond workload teams.

For practitioners

• Harden login velocity controls Set rate limits, IP reputation blocks, and progressive delays on authentication endpoints so automated attempts cannot cycle through large credential lists without friction.
• Correlate login anomalies across signals Join failed login spikes, user-agent mismatches, account lockouts, and successful logins into one detection rule so account takeover does not look like ordinary noise.
• Expand customer account monitoring Flag unusual access to names, addresses, transaction history, and profile changes so support teams can intervene before attackers use the session for fraud.
• Push unique-password adoption Require password managers in customer guidance and shorten the value of reused passwords by promoting unique credentials and stronger recovery flows.

Key takeaways

• Credential stuffing turns reused passwords into an identity attack path, not just an authentication nuisance.
• The breach exposed personal and transaction data without malware or lateral movement, which shows how little compromise is needed for meaningful impact.
• Rate limiting, anomaly detection, and MFA must operate together if teams want to reduce account takeover risk at scale.

Key terms

• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Login Velocity Control: Login velocity control limits how quickly and how often authentication attempts can occur from one source or across a set of accounts. It is a practical anti-automation measure that helps distinguish human mistakes from credential stuffing and reduces the attacker’s ability to test large credential lists.
• Authentication Telemetry: Authentication telemetry is the record of signups, logins, returning sessions, and other identity events generated by an auth system. It becomes useful when teams translate those events into operational signals for adoption, lifecycle health, and risk review rather than leaving them as raw logs.

What's in the full article

FireCompass's full post covers the incident detail this analysis intentionally leaves for the source:

• The timeline of the 2024-10-02 login activity and the later public reporting on 2025-10-08
• The specific log artefacts cited, including failed logons, successful logons, and suspicious IP patterns
• The customer remediation guidance in full, including password resets, MFA, credit monitoring, and fraud alerts
• The incident framing and attacker technique mapping to MITRE ATT&CK T1110

👉 FireCompass's full post covers the login indicators, customer impact, and remediation guidance in more detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.