The Fantasy Football Today Breach Gave Hackers 190K Accounts to Target

HEROIC analysts identified the Fantasy Football Today database among a collection of breach dumps being circulated on private Telegram channels in July 2016. The breach seperate from newer incidents but still very much in circulation, exposed 190,645 user records from fftoday.com, a site used by hundreds of thousands of football fans to manage fantasy leagues. The data continues to move through underground communities where it is sold and used to power automated attacks.

What Hackers Can Do With 190,000 Sports Fan Accounts

Attackers who get their hands on the Fantasy Football Today data can run credential stuffing attacks against popular sports apps, betting platforms, and email providers. They know sports fans often reuse the same password across multiple accounts. With usernames and plaintext passwords from this breach, criminals can try to access ESPN, DraftKings, PayPal, and email accounts belonging to the same people, potentially draining accounts or selling access to others.

What Was Exposed in the Fantasy Football Today Breach

• User account records (190,645 total)
• Usernames registered on fftoday.com
• Passwords stored in plaintext format

Why the Fantasy Football Today Leak Is a Bigger Deal Than It Looks

Plaintext passwords are partcularly dangerous because there is no cracking required. Attackers can use them directly. If a Fantasy Football Today user recieved the same password on their email or bank account, that account is at immediate risk of takeover. From there, identity theft and financial fraud become very straightforward for even low-skilled criminals using off-the-shelf automation tools.

How a Database Breach Works

A database breach happens when an attacker exploits a weakness in a website and copies the stored user records. When passwords are saved in plaintext rather than being scrambled with encryption, every single credential in the database becomes immediately usable by anyone who gets hold of the file. This makes plaintext password breaches among the most dangerous kind of data leak.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches over 400 billion leaked records to check whether your email or username appeared in the Fantasy Football Today breach or any other known data leak. Head to HEROIC.com for a free scan and protect your accounts before attackers get there first.