An investigation into an ongoing cyberattack that impacted thousands of betting accounts at the largest online sportsbooks has been escalated to the FBI, an industry source told ESPN.
Some customers, who were compromised and had funds withdrawn out of their personal bank accounts, were struggling to reach DraftKings and FanDuel representatives and had not been reimbursed more than a week after the attack began.
The FBI, when reached by ESPN, declined comment on the matter.
In a statement to ESPN on Wednesday night, DraftKings said the "majority of customer inquiries have been successfully resolved."
"We intend to restore the funds from any impacted withdrawals and appreciate the patience of our customers as we continue to work through this," a DraftKings spokesperson said.
DraftKings and FanDuel began noticing increasing unauthorized efforts to access accounts around Nov. 19. The hackers, armed with usernames and passwords believed to have been found on the internet, made deposits from bank accounts linked to the sportsbook accounts. They subsequently withdrew the deposited funds, sometimes within minutes of the initial transaction, to alternate accounts.
DraftKings estimated "less than $300,000" in unauthorized withdrawals were made from what the sportsbook said was a "small number" of accounts compromised in the attack. However, the company's customer service team appears to have been overwhelmed by the scope of issue, with many impacted bettors saying they had not been reimbursed and were having little success communicating with anyone from DraftKings more than a week after they were compromised.
In a statement to ESPN, the New Jersey Division of Gaming Enforcement said that it was aware of the "incident" and that those impacted should "contact customer service via email at sportsbook@draftkings.com and by leaving a voice message at 1(855)-357-2377."
FanDuel was still detecting increased unusual activity this week. The company created a task force in its customer service department to address the issue, but customers were experiencing difficulties communicating with the sportsbook.
Austin Herdina of Indiana had his FanDuel betting account compromised Nov. 26. He was first alerted by an unauthorized $5 deposit made to his FanDuel account. He tried to log in to his account but found that the password had been changed. Soon after, $5,200 was withdrawn from his bank account without his consent. As of Thursday, Herdina could not access his FanDuel account and had not been reimbursed.
"I was told [on Nov. 26 that] a representative would be contacting me to confirm my identity and unlock my account but that it could take one-two weeks because of the sheer volume of cases they have of this same thing happening to others," Herdina told ESPN on Tuesday. "I haven't received an email or phone call since."
Herdina said he waited more than 2½ hours on FanDuel's online chat Tuesday night without being able to reach anyone.
"If something was happening to someone's account right now, they wouldn't be able to alert FanDuel quick enough," Herdina said.
John Magnani, an avid daily fantasy sports player from New York, experienced a situation similar to Herdina's on DraftKings. On Nov. 20, while logging in to manage his fantasy lineups, Magnani said he noticed a $5 deposit and then a $5,000 withdrawal from his bank account "minutes later." He went into "immediate panic mode" after he found an unknown credit card and phone number and an address in Wisconsin associated to his account.
"I am a lifelong New Yorker and cannot understand how none of this raised any red flags with DraftKings," Magnani said in an email.
Magnani said that he has been reimbursed for the unauthorized withdrawal but that his DraftKings account was still linked to the fraudulent Wisconsin address, phone number and credit card this week.
The cyberattack, which a source says is more sophisticated than first believed, has caused the sportsbooks to take aggressive approaches toward any suspicious behavior, often locking betting accounts and leading to more customer frustration. State gaming regulators, including in New York, were monitoring the situation.
"The New York State Gaming Commission [NYSGC] is aware of the compromise and has been in regular communication with all sports wagering operators. specifically on the issue," the NYSGC said in a statement to ESPN. "The Commission, in its role as a regulator, will review the overall scope of the compromise in addition to the impact on the patrons' accounts. The Commission recommends all patrons double check their accounts."
Disclosure: ESPN has a business partnership with DraftKings, and the Walt Disney Company, ESPN's parent company, is an investor in DraftKings.