Cyberattack Targets Online Sportsbook, 18 Year Old Found Guilty

Just a few weeks after Gateway Casino's reopening following a temporary shutdown caused by a cyberattack on the franchise's security systems, more news makes headlines about a cyberattack on a sportsbook online for which an 18-year-old man from Wisconsin was convicted.

The online sportsbook in question is DraftKings which has been active since 2012, however, has not yet acquired the appropriate licensing and regulation in every American state.

The platform offers the opportunity for players to practice fantasy sports betting, essentially betting on virtual, fictional sports teams, and also sports betting options for real sports and esports contests.

Fantasy sports betting is also legal here in Canada with DraftKings being one of the websites available to us for this activity.

The cyberattack led to the jeopardy of over 60,000 user accounts on this platform.

The precise number according to DraftKings' announcement is 67,995.

Plans and action for the cyber attack had actually been in the works since November 2022 according to testimony and investigations on the matter.

The culprit who is still waiting for his conviction to be finalised is Joseph Garrison, an 18-year-old man from Madison in Wisconsin. It seems like Garrison had previously been involved in attacks on international websites such as Bitcoin too.

Although so far Garrison is the only one who has surrendered and is being questioned, it is believed he was not the only one involved in this large-scale attack which has put thousands of players' personal data and financial credentials at risk on the DraftKings website.

The sentence this young man might be facing is up to 20 years imprisonment for six counts of conspiracy, identity theft and fraud.

His crime is not the first of its nature, with "credential stuffing" becoming a phenomenon online which has been allowing for such cyberattacks to take place more frequently and easily.

Essentially, hackers acquire fake credentials such as usernames and passwords, home addresses and cellphone numbers on the dark web, which means they are able to infiltrate online sportsbooks and gambling platforms under the radar as seemingly legitimate players.

The allegations are that Garrison was able to withdraw funds from players' wallets on the sportsbook after gaining access to their accounts.

Information regarding how much money he successfully stole from these player accounts has not been explicitly released through the indictment, however, it has been estimated to surpass hundreds of thousands of U.S. dollars.

Once again, it was DraftKings that came out with more accurate estimations which according to its calculations added up to over $300,000 in stolen funds.

It was also not released through the indictment from the United States Attorney's Office of the Southern District of New York which platform had been affected by Garrision's cyberattack. It was DraftKings itself which released a statement on the matter following the investigation.

The investigation did reveal that back in November 2022, DraftKings had already suspected suspicious behaviour on the website and had only sent notifications to players who may have been affected.

However, we do wonder why the platform didn't immediately take more prompt and serious action.

Unfortunately, this reminds us of the money laundering case involving Branavan Kanapathipillai in Ontario, where despite suspicions, casinos did not always instantly file reports to authorities.

This negligence from the end of these online gambling and betting platforms is of just as much concern as the fact that it has become incredibly easy for hackers to access players' wallets on these websites.

It also makes us question how truly safe and protected these sites are being kept. What about the latest-technology encryption systems and firewalls they all boast?

The FBI and law enforcement's inspection of Garrison's home uncovered up to 40 million fake credentials he might have used in different instances.

The search also revealed disturbing texts Garrison had sent friends and assumed co-conspirators on similar crimes that he is "addicted to see[ing] money in [his] account" and that "fraud is fun".

We wonder whether these revelations from the investigation are the reason why his conviction hasn't been finalised yet and if there's a possibility that Garrison's mental state will be assessed prior to the official adjudication.

It is a complicated situation considering the several counts Garrison is being held accountable for, including a similar cyberattack on Fanduel, another fantasy sports and sports betting website. However, the repercussions on this website were not to the same extent.

It is evident more security needs to be put in place to protect online gamblers and their investments in this activity.

Events of cybercrimes of a similar nature, all of which are attacking online gambling platforms and their clients are being reported too often, even here in Canada especially following the regulation of online casinos and sportsbooks in April 2022.

Many questions pop up in our heads all of which are directed towards online casino operators and the relevant authorities.

It seems to be overlooked that this constant threat on these platforms and players shall be a cause for global economic decline and not only the economy of the affected casinos, sportsbooks and players.

We must also think about how players' interest might decrease following constant exposure to such news, if not being directly affected by these events.

Unfortunately, even after so many criminal events which have made news worldwide, we still don't see much being done towards maintaining more security on online casino and sports betting websites to avoid these attacks.

The only resolution we do have in light of this attack, in particular, is that evidently such cases are being taken more seriously and investigations are more thorough. In Garrison's case, it was also helpful that the culprit surrendered himself without resistance to authorities.