Where does the DraftKings, Inc. case file come from?

Every entry is taken from the breach report DraftKings, Inc. lodged with the Massachusetts Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: DraftKings, Inc. Data Breach

This file collects the dated facts on record for the DraftKings, Inc. incident. The state report is dated October 2, 2025.

Timeline

October 2, 2025Report filed in MassachusettsDate the notice was lodged with the Massachusetts Attorney General.

Case facts

Filing state: Massachusetts
Date reported: October 2, 2025
Receiving office: Massachusetts Attorney General

Case notes

DraftKings, Inc., a prominent digital sports entertainment and gaming company, reported a data security incident to the Massachusetts Attorney General's office on October 2, 2025. The company indicated that the incident is currently under investigation, with specific details still being evaluated.

As a large-scale platform, DraftKings routinely handles extensive personal information to ensure secure operations, identity verification, transaction processing, and overall account management for its millions of users. This includes a broad spectrum of sensitive customer data necessary for engaging with its services.

While the precise categories of personal information involved in this incident have not been specified in public filings, the compromise entailed unauthorized access to data. Such security breaches can create various risks for affected individuals, potentially including unauthorized account activity or other forms of personal information misuse.

Companies like DraftKings are obligated to implement and maintain robust security measures to protect the personal information they collect and store. Receiving a data breach notification from DraftKings indicates that the company has determined some of your personal information may have been affected by this incident.

Individuals who receive official notification from DraftKings, Inc. are advised to remain vigilant. General protective steps include carefully reviewing financial account statements and credit reports for any suspicious or unauthorized activity. It is also recommended to enable multi-factor authentication on all online accounts and consider updating passwords, particularly for accounts connected to DraftKings or those using similar credentials.

Questions about this case file

Where does the DraftKings, Inc. case file come from?: Every entry is taken from the breach report DraftKings, Inc. lodged with the Massachusetts Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Massachusetts data breaches

Named in the DraftKings, Inc. breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Massachusetts case files