The FanDuel sportsbook and betting site suffered a data breach incident after which it warned the customers that their names and email addresses were exposed in a MailChimp security breach. It also urged users to remain vigilant against phishing emails. On January 13th, MailChimp confirmed they suffered a breach after hackers stole an employee’s credentials using a social engineering attack and this attack affected FanDuel customers.

Two Connecticut Men Charged in $3M Online Gambling Fraud Scheme Using Stolen Identities Two Connecticut residents, 29-year-old Amitoj Kapoor and Siddharth Lillaney of Glastonbury, were arrested on Thursday after a federal grand jury indicted them on 45 counts related to a multi-year fraud scheme targeting online gambling platforms. The pair allegedly defrauded FanDuel, DraftKings, BetMGM, and other sites of $3 million using stolen personally identifiable information (PII) from approximately 3,000 victims. Between April 2021 and 2026, Kapoor and Lillaney purchased stolen PII including names, dates of birth, addresses, Social Security numbers, and contact details from darknet markets and Telegram. They then used this data to create thousands of fraudulent gambling accounts, leveraging background-check services like TruthFinder and BeenVerified to bypass verification processes. Kapoor maintained a spreadsheet, "Tracker.xlsx," to organize the stolen information, as evidenced by text messages discussing the use of reverse phone searches to match identities. The scheme exploited promotional bonuses offered to new users, allowing the defendants to place bets with stolen funds. When winnings were secured, they transferred the proceeds to virtual stored-value cards and then into personal bank and investment accounts. The indictment includes charges of conspiracy to commit wire and identity fraud, wire fraud (23 counts), identity fraud (8 counts), aggravated identity theft (2 counts), and money laundering (11 counts). If convicted, Kapoor and Lillaney face decades in prison, with aggravated identity theft carrying a mandatory two-year consecutive sentence. U.S. Attorney David X. Sullivan stated that the defendants "used thousands of stolen identities to open online gambling accounts and exploit new user incentives," while IRS Special Agent in Charge Thomas Demeo emphasized the "immeasurable hardship" caused to victims. Both were released on $300,000 bond pending trial.