Small business owners: credential stuffing is happening now, and a major platform just warned its users about it. DraftKings recently alerted customers to account breaches tied to reused passwords, a reminder that a single weak password can unlock many doors.
What happened
DraftKings issued customer alerts indicating some accounts were breached due to credential stuffing. In credential stuffing, attackers use usernames and passwords gathered from other breaches to try to gain access to many accounts across services. This attack method thrives on password reuse and weak MFA adoption. The company said customers may have been affected and advised steps to protect accounts. Details may change as the investigation continues.
Why it matters
- Individuals: reused passwords can lead to account takeovers. MFA greatly reduces this risk.
- Small businesses: employees often reuse passwords across work and SaaS tools, which can threaten domains and email. Enforcing MFA and monitoring sign-ins helps.
- Creators and IT-minded readers: adding passkeys where possible and strengthening MFA are practical, low-friction defenses that reduce attacker chances.
What you can do in under 15 minutes
- Enable MFA for all user accounts in your identity provider and require MFA for admins. If you use Microsoft 365, go to the admin center > Users > Active Users > Multi-factor Authentication, and enable it for all users with admin-level enforcement.
- Set up passkeys where supported and use a password manager to centralize credentials. Look for passkey options in your preferred password manager and supported apps/sites, then enable biometric or device-based access where available.
- Run a quick 10-minute ownership check:
- Confirm that admin and domain contact emails are correct and reachable.
- Review last 24 hours of sign-in activity in your admin portal for unusual or failed attempts.
- Verify account recovery options (backup email, phone) are up to date.
- Look for unknown devices or sessions and revoke any you don’t recognize.
- Audit high-value accounts (domain, hosting, email) and rotate their passwords if you suspect exposure.
- Disable legacy authentication protocols (IMAP/POP/basic auth) where possible to reduce credential-stuffing risk.
- Turn on login alerts and, if available, conditional access or IP-based controls for sensitive apps and admin portals.
- Cost note: MFA is free on most platforms; hardware security keys can add protection if you need stronger assurance.
Final thought
Credential stuffing is a reminder that passwords alone aren’t enough. A quick, focused security check now can prevent bigger headaches later. Start with MFA, add passkeys where possible, and keep an eye on sign-in activity. If you want help setting up MFA or a 10-minute security check, use your identity provider’s help docs or reach out to your IT support.