Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: DraftKings’ 2024 account breach shows how stolen credentials and automated login attempts can still defeat consumer authentication controls, with attackers reaching names, addresses, transaction history, and partial payment data, according to FireCompass. The case reinforces that rate limiting, anomaly detection, and MFA must be paired with stronger password hygiene and account-takeover monitoring.
NHIMG editorial — based on content published by FireCompass: DraftKings Credential Stuffing Account Breach
By the numbers:
- Attackers attempted access within an average of 17 minutes when AWS credentials are exposed publicly, and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, including 46% confirmed cases and 26% suspected cases.
Questions worth separating out
Q: What breaks when credential stuffing is not blocked at the login layer?
A: The login plane becomes a low-cost test bed for stolen credentials, and one valid reuse can turn into account takeover.
Q: Why does credential stuffing create fraud risk even when payment data is only partially exposed?
A: Partial exposure is often enough to support social engineering, account recovery abuse, and targeted fraud.
Q: How can security teams tell credential stuffing from ordinary user login failures?
A: Look for rapid sequential attempts, unusual IP diversity, user-agent anomalies, account lockouts followed by success, and failure bursts across many accounts.
Practitioner guidance
- Harden login velocity controls Set rate limits, IP reputation blocks, and progressive delays on authentication endpoints so automated attempts cannot cycle through large credential lists without friction.
- Correlate login anomalies across signals Join failed login spikes, user-agent mismatches, account lockouts, and successful logins into one detection rule so account takeover does not look like ordinary noise.
- Expand customer account monitoring Flag unusual access to names, addresses, transaction history, and profile changes so support teams can intervene before attackers use the session for fraud.
What's in the full article
FireCompass's full post covers the incident detail this analysis intentionally leaves for the source:
- The timeline of the 2024-10-02 login activity and the later public reporting on 2025-10-08
- The specific log artefacts cited, including failed logons, successful logons, and suspicious IP patterns
- The customer remediation guidance in full, including password resets, MFA, credit monitoring, and fraud alerts
- The incident framing and attacker technique mapping to MITRE ATT&CK T1110
👉 Read FireCompass's analysis of the DraftKings credential stuffing breach →
Credential stuffing account takeover: what IAM teams should change?
Explore further
06/09/2026 6:21 pm
Credential stuffing is an identity governance failure before it is a login problem. The breach worked because reused credentials remained valid enough to be weaponised at scale, and because account controls were not sufficiently tuned to detect automation. That is a consumer IAM weakness, but it also matters to any programme that still treats authentication as a binary success or failure event rather than an access risk signal.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Should organisations prioritise MFA or login anomaly detection first?
A: They should do both, but detection and throttling often need immediate attention when reused passwords are already in circulation. MFA reduces exposure, yet it does not stop password reuse patterns or give early warning when attackers are testing many accounts at once.
👉 Read our full editorial: DraftKings credential stuffing shows why MFA alone is not enough
