Fantasy Sports and Betting Website Hacker Sentenced for Credential Stuffing Attack Compromising 60,000 Accounts
Published
Key Takeaways
- Sentence Imposed: Minnesota man Nathan Austad received 18 months in prison for involvement in a credential stuffing attack.
- Third Defendant: Austad joins co-defendants Joseph Garrison and Kamerin Stokes in being sentenced in the investigation.
- Scope Confirmed: The attackers used darknet-bought credentials to compromise roughly 60,000 accounts and netted about $600,000 from 1,600 of them.
Nathan Austad, also going by the alias "Snoopy," was sentenced to 18 months in prison for hacking user accounts on a fantasy sports and betting website and selling access to those accounts. The attackers purchased stolen credentials for the dark web.
Inside the Credential Stuffing Attack
On December 12, 2025, Austad, 21, of Farmington, Minnesota, pled guilty to one count of conspiring to commit computer intrusion. On or about November 18, 2022, Austad and his coconspirators launched a credential stuffing attack against the unnamed website.
They systematically tested stolen username and password pairs purchased on the dark web against user accounts, the Department of Justice (DOJ) said citing court documents. The operation successfully compromised approximately 60,000 user accounts.
In many cases, the defendants added their own payment methods to victim accounts and withdrew existing funds, stealing roughly $600,000 from about 1,600 accounts. Austad also controlled cryptocurrency accounts that received approximately $465,000, including criminal proceeds.
Darkweb Shop and Co-Defendant Sentences
Austad directly controlled and profited from his own "Shop," named after the Peanuts character Snoopy, which trafficked stolen account access. He was ordered to pay $463,684.48 in forfeiture and $1,327,061 in restitution, and he also received three years of supervised release.
Austad is the third defendant sentenced in the investigation. Joseph Garrison received 18 months in 2024, and Kamerin Stokes, using the alias "TheMFNPlug," received 30 months on April 16, 2026.
Last month, Ukraine began investigating a teen suspected of breaching 30,000 customer accounts at a California-based online retailer using infostealers. Late last year, the DOJ seized a stolen password database and domain to halt account takeovers and disrupt a fraud network.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular