Third Defendant Pleads Guilty To Hacking Fantasy Sports And Betting Website

United States Attorney for the Southern District of New York, Jay Clayton, announced the guilty plea today of NATHAN AUSTAD, a/k/a “Snoopy,” in connection with a scheme to hack thousands of user accounts at a fantasy sports and betting website (the “Betting Website”) and sell access to those accounts in order to steal hundreds of thousands of dollars from the true users, including victims in the Southern District of New York.  AUSTAD pled guilty today to conspiracy to commit computer intrusion before U.S. District Judge Ronnie Abrams.

“Today’s guilty plea shows our Office’s commitment to holding cybercriminals who hack and steal from our citizens to account,” said U.S. Attorney Jay Clayton.  “Austad and his co-defendants robbed their victims, including New Yorkers, and shamelessly sold their private account information online.  Let this be a warning: hackers and cybercriminals who target New Yorkers will be brought to justice.  The women and men of our Office are watching and are committed to protecting the public from cyber intrusions, theft, and the online criminal markets that enable them.”

According to the charging documents and statements made in public filings and public court proceedings:

On or about November 18, 2022, AUSTAD and others launched a “credential stuffing attack” on the Betting Website.  During a credential stuffing attack, a cyber threat actor collects stolen credentials, or username and password pairs, obtained from other large-scale data breaches of other companies, which can often be purchased on the dark web.  The threat actor then systematically attempts to use those stolen credentials to obtain unauthorized access to accounts held by the same user with other companies and providers in order to compromise accounts where the user has maintained the same password.  Here, in connection with the attack on the Betting Website, AUSTAD and his co-conspirators made a series of attempts to log into the Betting Website user accounts using a large list of stolen credentials.

AUSTAD and his co-conspirators successfully compromised approximately 60,000 user accounts at the Betting Website (the “Victim Accounts”) through the credential stuffing attack.  In some instances, AUSTAD and his co-conspirators were able to add a new payment method of their own on the account (i.e., to a newly added financial account belonging to the hacker) and then use it to withdraw all the existing funds in the Victim Account to themselves, thus stealing the funds in each affected Victim Account.  Using this method, AUSTAD and others stole approximately $600,000 from approximately 1,600 Victim Accounts on the Betting Website.

Access to the Victim Accounts was also sold on various websites that traffic in stolen accounts, which are frequently referred to as “Shops.”  AUSTAD directly controlled and profited from his own shop, which was named after the character Snoopy from the Peanuts comic strip.  A photo of AUSTAD’s Shop website with victim companies redacted is below:

On or about December 2, 2022, AUSTAD messaged about the existence of this investigation, “everyone shouldve been prepared for this before cashing out lol,” and a co-conspirator replied, “lol fbi can’t do shit.”  On or about May 19, 2023, AUSTAD messaged about the existence of this investigation, “like we didnt know the risk when we started lol . . . everyone knows their committing fraud.”

AUSTAD also controlled cryptocurrency accounts that received cryptocurrency worth approximately $465,000, including proceeds of his crimes.

*               *                *

AUSTAD, 21, of Farmington, Minnesota, pled guilty to one count of conspiring to commit computer intrusion, which carries a maximum sentence of five years in prison.

The maximum potential sentence is prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendant will be determined by the judge.  AUSTAD is scheduled to be sentenced by Judge Abrams on April 10, 2026.

Mr. Clayton praised the outstanding work of the Federal Bureau of Investigation. 

The case is being prosecuted by the Office’s Complex Frauds and Cybercrime Unit. Assistant U.S. Attorneys Kevin Mead and Micah Fergenson are in charge of the prosecution.