HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
DraftKings Inc.
bd_2cca4016b7a2eefe · schema v1 · pii pii-v1
Full breach record for DraftKings Inc. →DraftKings Inc. reported a credential stuffing attack on November 18, 2022, affecting 67,995 individuals, including 125 Maine residents. The breach involved the acquisition of personal identifiers combined with government-issued IDs. DraftKings, represented by outside counsel Cozen O'Connor, sent written notifications on December 16, 2022. No identity theft protection services were offered.
Maine clockDiscovered Nov 18, 2022 → Filed with AG Dec 16, 202228d ✓ ME AG ≤30d28 days discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_627aa6b96afe0596Oregon State AGfiled 2023-02-09(55d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/224e06d4-90d1-402d-ae66-bfde68c87924.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 16, 2022
- Raw hash
- 815741980b6ba7d391142acc7d78084359ec45fa5b20547efd672d79ab88db54
Reporting entity
- Name
- COZEN O'CONNORnorm: cozen o connor
Victim entity
- Name
- DraftKings Inc.norm: draftkings
Incident
- Discovered
- Nov 18, 2022
- Materiality determined
- —
- Notification sent
- Dec 16, 2022
- Affected individuals
- 67,995
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1110 Brute Force
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 28d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Nov 18, 2022→ Filed with AG: Dec 16, 202228d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.