Reported by Lukas I. Alpert

A boastful teenage hacker has been charged with orchestrating a break-in to the sports betting website DraftKings, which led to $600,000 being drained from hundreds of customer accounts.

Joseph Garrison, 18, of Madison, Wis., is accused of using stolen log-in and password combinations he bought on the dark web to hack his way into 60,000 accounts on DraftKings last November. He then sold the information to others who used it to drain 1,600 customer accounts, federal prosecutors in Manhattan said.

This technique of hacking is known as credential stuffing, which works best when online users utilize the same password and log-in name across multiple sites.

“Fraud is fun,” Garrison allegedly wrote in a text message to a co-conspirator, court documents said. “I’m addicted to seeing money in my account.”

DraftKings is not named in the criminal complaint, but the company confirmed that some of its customers’ accounts had been compromised in the scheme and said that it had restored the money that had been stolen.

Garrison surrendered to authorities in New York on Thursday morning and was scheduled to make his first appearance before a judge later in the day. It wasn’t immediately clear if he had retained an attorney in the hacking case and an attorney who represented him in the earlier swatting case didn’t immediately respond to a message seeking comment.

But five months later, he allegedly committed the credential stuffing attack on the DraftKings site, prosecutors said. Employees at DraftKings were able to zero in on Garrison after launching their own investigation and buying back some of the stolen credentials he was selling on the dark web, prosecutors said.

Read full report: https://www.marketwatch.com/amp/story/fraud-is-fun-teen-hacker-charged-with-breaking-into-draftkings-accounts-leading-to-theft-of-600-000-c5881161