Federal prosecutors on Thursday unsealed a six-count indictment against an 18-year-old Wisconsin man accused of orchestrating a plot to hack into user accounts at a fantasy sports and sports betting website and steal $600,000.

In a complaint filed in the Southern District of New York on Monday, the government charged Joseph Garrison with six counts of hacking, wire fraud and identity theft, accusing him of purchasing usernames and passwords of the site’s customers on the dark web, then using that information to obtain access to 60,000 accounts on the site in November of last year.

Garrison then, according to the complaint, sold the credentials to those user accounts “through various websites that marketed and sold illegal account credentials.” The purchasers of those credentials then stole approximately $600,000 from 1,600 user accounts, prosecutors allege.

Though the complaint does not name the site that was the victim of the hack, The Action Network confirmed that DraftKings was the victim, and that all funds were returned to the users’ accounts.

Among the evidence provided in the complaint were chats found on Garrison’s phone that took place two months before the attack. Among the messages Garrison sent in the chats to an unnamed co-conspirator were:

“fraud is fun.”

“im addicted to see money in my account.”

“I do a lot of other types of fraud.”

According to the complaint, Garrison in June 2022 admitted he had previously hacked into accounts and sold the information on a site he ran called Goat Shop. He allegedly told police at the time that he sold the information on Goat Shop from 2018-21, made as much as $15,000 per day doing it, and brought in about $800,000 total from the site.

Each of the three hacking-related charges carries a maximum five-year prison sentence; the ID theft charge carries a mandatory minimum two-year sentence in prison; and each of the two wire fraud charges carries a maximum 20-year prison sentence.

–Field Level Media