The DraftKings cyberattack involved credential stuffing attacks that exploited weak or reused user credentials to access customer accounts. Attackers added payment methods under their control to some accounts and stole funds. Nathan Austad, known as "Snoopy," was convicted and sentenced for his role in the conspiracy, which included selling access to compromised accounts. The incident is a criminal case involving account compromise rather than a disclosed software vulnerability. No technical vulnerability details or patches are provided.

Approximately 67,995 DraftKings user accounts were compromised, with attackers adding payment methods to 1,600 accounts and stealing about $600,000. The attackers also profited by selling access to compromised accounts. This resulted in financial loss to users and damage to DraftKings' customer trust. There is no indication of a software flaw or ongoing exploit beyond credential stuffing attacks exploiting weak or reused passwords.

No specific software patch or fix is indicated. Mitigation focuses on preventing credential stuffing attacks by enforcing strong, unique passwords and multi-factor authentication for user accounts. Users should avoid password reuse and monitor accounts for unauthorized activity. DraftKings and similar services should implement protections against credential stuffing, such as rate limiting and anomaly detection. Since this is a criminal case outcome, no direct remediation or patch is applicable.