DraftKings, a digital sports entertainment and gaming company, has been linked to a possible data exposure by a ransomware group’s public claim. This page explains what has been reported, what has not been confirmed and what customers can do now.
Everything below reflects public reporting and may change as the company or a regulator releases information.
DraftKings’s Data Breach Investigation
DraftKings is a Massachusetts-based digital sports entertainment and gaming company. Its products include an online sportsbook, online casino games, daily fantasy sports and related apps, which means it serves a large audience of customers who create accounts, add payment methods and verify their identities in order to play.
The possible incident came to light through a listing on a ransomware-monitoring site dated November 11, 2026. The listing attributes the claim to a group calling itself N0n. According to the descriptions republished by cybersecurity tracking services, the group claims to hold several datasets connected to gaming audiences. Those datasets are described as including mobile advertising identifiers, hashed consumer email addresses and campaign demographic analytics.
One detail stands out in the reporting. The listing describes datasets dated 2019 and 2020, so it does not establish that the material was newly obtained in 2026. Marketing and audience datasets of this kind are often assembled for advertising campaigns and can pass through several vendors and partners. The claim does not say whether the material came from DraftKings’ own systems, from a partner or from somewhere else.
It is important to be clear about the status of this information. A listing on a ransomware group’s leak site is a claim made by the people who say they obtained the data. It is not a confirmation from the company, and such claims can turn out to be overstated, outdated or wrong. At the time of writing, DraftKings has not published a notice about a data security incident, and no state attorney general or other regulator filing for the company has been identified.
As a result, several basic questions remain unanswered. No count of affected people has been established. It is not clear how many individuals the datasets actually cover, since advertising identifiers and hashed emails can overlap and may not map to unique customers. The company has not said whether any current or former customers are affected, how an intruder might have obtained the data or whether any of it was drawn from live customer accounts.
The categories named in the claim differ from the information that usually drives identity theft. The reporting does not identify Social Security numbers, financial account data or medical information. Even so, hashed email addresses and advertising identifiers are not harmless. Hashed emails can sometimes be reversed or matched to named individuals, and that kind of linkage can make phishing messages more convincing and more targeted. People who bet or play online are also frequent targets of scams that pretend to come from the platform.
Gaming and sports betting platforms hold sensitive account information, including identity verification records, payment details and betting history. That makes them attractive to attackers, and it is the reason customers often take extra care after any report involving such a company. These points are general to the industry and are not a statement about what was actually exposed here.
Under state breach laws, a company that confirms unauthorized access to certain categories of personal information generally has to notify the people affected, and larger incidents may also be reported to state officials. Those notices usually arrive weeks or months after an incident is discovered, because the company first has to investigate. The absence of a notice today does not mean that nothing happened, and it does not mean that something did.
For now, treat the situation as a developing one. Watch for any email or letter from DraftKings, and keep a notice if you receive one. Compare any official statement with the claim described above, paying particular attention to which datasets, which dates and how many people it covers. The protective steps below cost little and are sensible whether or not the claim is later confirmed.
When Did This Breach Occur?
A ransomware-monitoring listing dated November 11, 2026 is the earliest public report of the claim. The datasets it describes are dated 2019 and 2020, and the listing does not say when any unauthorized access took place. DraftKings has not said when any incident began, when it was discovered or when it was contained, and no notification date has been published. If the company releases a timeline, compare it with the information in any notice you receive.
What Information Was Breached?
The information involved has not been confirmed. The ransomware group’s claim, as republished by tracking services, refers to mobile advertising identifiers, hashed consumer email addresses and campaign demographic analytics. DraftKings has not published a notice listing which categories of information were affected, and no regulator filing has been identified. The reporting does not mention Social Security numbers, financial account data or medical information, but the company has not confirmed any of this.
What You Can Do
If you received a notice related to DraftKings or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Change your DraftKings password and the password for any other account that shares it, turn on multi-factor authentication, and be wary of messages that appear to come from the company asking you to confirm account or payment details.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against DraftKings
Attorneys are looking into the reported DraftKings data incident and want to hear from customers who believe their information may have been exposed. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately confirms about the incident. If you received a notice or suspect your information was involved, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
