DraftKings Data Breach

DraftKings, one of the largest U.S. sports betting and daily fantasy sports platforms, appeared on the N0n ransomware group’s leak portal on November 11, 2026, according to SOCRadar’s Dark Web Monitoring. The listing is unverified and should be treated as an alleged claim rather than a confirmed breach. DraftKings operates at significant scale, serving millions of registered users while handling financial transactions, identity verification data, and account credentials. This combination of financial data, sensitive personal information, and a large active customer base makes the platform a high-value target for ransomware and extortion activity. N0n has claimed roughly 270 victims in the preceding 60 days, with targeting concentrated in the United States, Canada, and South Korea and a particular appetite for technology and retail companies. Recent U.S. listings published alongside DraftKings include LiveRamp (Technology), Infutor Data Solutions (Technology), Staples, Inc. (Retail & E-Commerce), and Chartboost LLC (Technology). DraftKings fits this pattern closely: it is a U.S.-based organization with a retail and e-commerce classification, placing it squarely within both the geographic and sector preferences N0n has demonstrated over the past two months. The volume of claims over the period points to an active, high-tempo campaign rather than an isolated listing.

SOCRadar’s stealer-log correlation against draftkings[.]com returned 25 records, and the composition of the sample is strikingly consistent. Every record points at consumer-facing authentication endpoints: myaccount.draftkings[.]com, the password-reset endpoint, and the primary sportsbook login. Every username in the sample belongs to a consumer email provider — Gmail, Yahoo, Hotmail, Comcast, iCloud, and ProtonMail — and no employee or corporate credentials appeared in the results. The observed exposure is therefore concentrated on customer accounts rather than internal corporate authentication. Freshness is the most notable element of the signal. Twenty-four of the 25 records are dated November 10–11, 2026, coinciding directly with the leak-site listing date, while a single long-tail record dates to December 2024. A cluster of freshly harvested consumer credentials appearing at the same time as a ransomware claim warrants elevated concern, even though the stealer-log data does not connect directly to N0n’s internal access pathway. On the current evidence, the telemetry supports a customer account takeover scenario rather than a confirmed corporate network intrusion, and the two should not be conflated. The overall pattern points to customer account takeover rather than corporate network intrusion. The volume and timing of the consumer-facing credential records nonetheless warrant elevated concern. Gaming platforms operate under consumer protection and gaming regulatory obligations, and user-facing notification requirements may apply if customer accounts were compromised as part of the broader incident. DraftKings’ trust and safety functions should assess whether customer account takeover played a role in the incident, and continued dark web and stealer-log monitoring for additional draftkings[.]com records is advisable given the elevated concern.