DraftKings credential stuffing shows why MFA alone is not enough

At a glance

What this is: This is a credential stuffing account takeover case in which attackers used stolen login pairs to access DraftKings customer accounts and view personal and transactional data.

Why it matters: It matters because IAM teams cannot treat MFA as a complete defence when password reuse, automated login attempts, and account monitoring gaps still allow takeover.

Context

Credential stuffing is an account takeover technique that uses pairs of usernames and passwords leaked from other breaches, then automates login attempts until one works. In this case, the attack targeted customer accounts rather than backend infrastructure, so the control failure sits in authentication, credential hygiene, and detection.

For IAM practitioners, the key issue is that MFA alone does not neutralise reused passwords if the attacker can still trigger a valid login flow. The governance problem is account abuse at scale, not malware, and the defensive question is how to detect abnormal login behaviour before successful access occurs.

Key questions

Q: What breaks when stolen credentials are replayed as valid logins?

A: What breaks is the assumption that successful authentication equals legitimate use. When cookies, tokens or passwords are replayed, the attacker can look like a trusted user while bypassing malware detection. Security teams need evidence that ties the login to exposure history, device context and downstream actions before they can call it benign.

Q: Why do exposed passwords still lead to account takeover even when MFA exists?

A: Because MFA does not fix password reuse across other services, and not every target enforces the same second factor. Attackers often use exposed credentials against weaker or older login surfaces, or against sessions already established elsewhere. Password breach monitoring matters because it finds the exposure before the credential is widely reused.

Q: What are the signs that credential stuffing is failing your login controls?

A: Common signs include sudden spikes in login attempts, many attempts from anonymous or low reputation sources, repeated use of known exposed credentials, and successful account access followed by unusual customer activity. If MFA is present but takeover still occurs, the organisation likely needs stronger screening, tighter risk based authentication, and better monitoring at the authentication layer.

Q: How should organisations reduce MFA-related account takeover risk?

A: Start by replacing the weakest factors on the highest-risk accounts, then remove recovery paths that depend on shared secrets or easily intercepted delivery channels. Pair that with risk-based step-up, strong offboarding, and continuous review of fallback access. The goal is to make takeover harder without turning authentication into a usability failure.

Technical breakdown

How credential stuffing bypasses password-centric authentication

Credential stuffing succeeds when attackers replay valid credential pairs across consumer login surfaces at high speed. Because the username and password combination is legitimate, the application often sees a normal authentication event until rate limits, device risk signals, or anomaly models intervene. MFA can raise the bar, but it does not remove the initial trust in the password channel. In this case, the attack used automated login attempts and produced rapid failures followed by success, which is a classic replay pattern rather than exploitation of a software flaw.

Practical implication: treat password reuse as an authentication failure condition, not just a user behaviour issue.

Why login telemetry matters more than access success alone

Authentication logs can reveal a stuffing campaign before an account is fully abused. Signals such as repeated failures, unusual user agents, suspicious source IPs, and lockout followed by success indicate automated credential testing rather than normal human login behaviour. For defenders, the value is in correlating these events at the identity layer, not in waiting for fraud reports or downstream support tickets. MITRE ATT&CK maps this pattern to brute-force driven initial access because the attacker is using scale and repetition to find valid sessions.

Practical implication: build detection on repeated failures, geo-velocity anomalies, and rapid success after lockout.

Why MFA reduces risk without closing the account takeover path

MFA is an important additional control, but it does not repair weak password discipline or eliminate all account-takeover paths. If an attacker can satisfy the primary password check and the MFA challenge is weak, poorly enforced, or inconsistently adopted, the account remains exposed. The right mental model is layered authentication plus behaviour monitoring, not MFA as a standalone shield. This case shows that authentication strength depends on the whole login journey, including recovery flows, password resets, and post-login activity review.

Practical implication: pair MFA with password manager adoption, login-rate controls, and review of account recovery paths.

Threat narrative

Attacker objective: The attacker objective was to take over customer accounts and access personal and transactional information for abuse or resale.

1. Entry occurred through automated credential stuffing that replayed stolen username and password pairs against customer login flows.
2. Credential validation succeeded for some accounts after repeated failures, giving attackers authenticated access without malware or system exploitation.
3. The attackers could then view customer profile and transaction information, turning account access into privacy and fraud exposure.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential reuse is the real control failure here: this breach worked because the authentication model still assumed that a password pair identifies a legitimate user. That assumption fails when stolen credentials can be replayed at machine speed from outside the organisation. The implication is that IAM programmes must treat password reuse as an account-takeover risk, not a user-training side issue.

MFA narrows exposure, but it does not eliminate identity abuse at the login boundary: attackers did not need malware, privilege escalation, or lateral movement because the control plane failed at the point of authentication. This is a governance gap, not a tooling gap, because the relevant question is whether the login journey can absorb automated credential attacks before success. Practitioners should recognise that authentication strength is only as good as the surrounding telemetry and enforcement.

DraftKings shows a named concept we should track: login replay exposure. A login replay exposure exists when stolen credentials can be tested repeatedly until a valid session is created, even in environments with MFA. That pattern shifts the security burden from preventing theft alone to limiting replay opportunities, detecting abnormal velocity, and constraining account recovery abuse. For the field, this makes account-takeover governance part of core identity security, not an edge case.

Detection must move from successful-login review to pre-authentication interdiction: the observable evidence here was a burst of failures, odd IP activity, and successful logins after repeated attempts. Those signals matter because they show the attack was visible before full compromise. The lesson for practitioners is to design controls that stop the campaign while it is still testing credentials, not after the account is already in use.

Consumer IAM and workforce IAM now share a common attack pattern: credential stuffing is not unique to customers, and the same behavioural logic applies wherever reused secrets can be replayed. The practical implication is that identity programmes should align password manager adoption, risk-based authentication, and anomaly detection across user populations instead of treating consumer login abuse as a separate problem class.

What this signals

Login replay exposure: the governance gap is not just stolen passwords, but the ability to replay them against live sign-in flows until one succeeds. Identity programmes should treat repeated login attempts as an abuse case that needs enforcement at the authentication edge, not only post-incident review.

Credential stuffing is a reminder that authentication strength depends on password hygiene, retry control, and monitoring together. When those controls are fragmented, the attacker can stay inside normal login mechanics long enough to create account takeover without touching the backend application stack.

For practitioners

• Harden login surfaces against credential stuffing Add rate limiting, device and IP reputation checks, lockout logic, and velocity-based detection on authentication endpoints so automated replay cannot test passwords at scale.
• Reduce password reuse across customer populations Push password manager adoption, block commonly reused passwords, and treat known-breached credential checks as part of account creation and sign-in.
• Tune MFA to the actual takeover path Require MFA, but also review recovery flows, reset processes, and step-up logic so the attacker cannot simply move to a weaker path after the first challenge.
• Correlate identity telemetry for early warning Alert on bursts of failed logins, unusual user agents, suspicious source IPs, and successful logins after lockout so analysts can stop stuffing campaigns before data access expands.

Key takeaways

• Credential stuffing turns reused credentials into a practical account takeover path, even when MFA is present.
• The incident produced clear identity-layer evidence, including rapid login failures followed by successful access and exposure of customer profile data.
• Rate limiting, password hygiene, and behavioural monitoring are the controls most directly aligned to this failure mode.

Key terms

• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Login Anomaly Detection: Login anomaly detection is the practice of flagging unusual sign-in patterns such as repeated failures, suspicious geographies, odd user agents, or rapid success after lockout. It gives IAM teams earlier warning that authentication is being abused at scale.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.