Teen boasted ‘fraud is fun’ before hacking sports betting site, stealing $600,000: Feds

metro

by Priscilla DeGregory

May 18, 2023 | 2:44 p.m

Federal prosecutors in Manhattan on Thursday charged a Wisconsin teen with “fun fraud” before hacking into user accounts on a sports betting site and helping others steal $600,000.

The federal government alleged that Joseph Garrison, 18, is accused of passing the login information for 60,000 accounts in the Nov. 18 cyberattack, and then selling the data, allowing others to steal money from some users.

In total, the Madison man allegedly helped others loot $600,000 from a total of 1,600 users — with at least 30 of those accounts traced back to New York, prosecutors said.

Before Garrison carried out the main hack, he bragged in letters to one of his co-conspirators on Sept. 16 that “fraud is fun,” adding that he was “addicted to seeing [sic] The money is in my account,” according to the criminal case against him.

Authorities got wind of a “credential stuffing attack” scheme after workers at the sports betting site purchased stolen credentials and received detailed instructions and screenshots on how to steal money from user accounts, the feds claim.

An undercover agent purchased login information for two accounts on Jan. 9 for $11 and was also given instructions and screenshots on how to steal user funds, according to the complaint.

Prosecutors said that when law enforcement searched Garrison’s home in February, they found software used for credential stuffing attacks and files containing nearly 40 million combinations of usernames and passwords.

Investigators also found messages on Garrison’s phone discussing with his co-conspirators how to hack the betting site and how to make money from it, the allegation says.

In one letter, Garrison allegedly bragged about how good he was at credential stuffing attacks, saying he loved doing it and believed he’d never get caught, the feds said.

In June 2022, Garrison admitted to Madison police a hacking scheme he carried out from 2018 to 2021, claiming that he made about $15,000 on a good day and that he took $800,000, according to the complaint.

But when the feds went through his phone, they found a screenshot showing he had made more than $2 million in sales on the scheme, the complaint alleges.

The complaint also claims that he told Wisconsin cops that he stopped hacking in 2021.

Garrison is charged with conspiracy to commit computer intrusions, unauthorized access to a protected computer for further intended fraud, unauthorized access to a protected computer, wire fraud and aggravated identity theft.

He faces up to 20 years behind bars if convicted on top of the charge.

“As alleged, Garrison used a credential stuffing attack to hack into the accounts of tens of thousands of victims and steal hundreds of thousands of dollars,” U.S. Attorney Damien Williams said in a statement.

“Today, thanks to the work of my office and the FBI, I learned from Garrison that you shouldn’t bet to get away with fraud.”

Garrison turned himself in Thursday.

His attorney, Clay Kaminsky, declined to comment.