Latest News
Popular Gambling App Exposed Millions of Users in Massive Data Leak
Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a data breach on casino gambling app Clubillion.
The breach originated in a technical database built on an Elasticsearch engine and was recording the daily activities of millions of Clubillion players around the world.
Aside from leaking activity on the app, the breached database also exposed private user information.
With this information publicly available, Clubillion’s users were vulnerable to fraud and various online attacks with potentially devastating results.
Company Profile
Clubillion is a free online casino game available for iOS and Android, offering players 30+ free slot games. While each app is listed under a different developer – Ouroboros on iOS and T7 Games on Android – these are most likely owned by the same company.
Both versions of Clubillion were released in 2019 and became instant hits. Each is now ranked the #1 ‘social slots’ casino app on Google Play and the App Store, with a 4.8 star on both.
Timeline of Discovery and Owner Reaction
Sometimes, the extent of a data breach and the owner of the database are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data.
Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness.
Some affected parties deny the facts, disregarding our research, or playing down its impact. So, we need to be thorough and make sure everything we find is correct and accurate.
In this case, the database was built on Elasticsearch and hosted on Amazon Web Services (AWS), with Clubillion’s name on its apps, and links to assets owned by the company.
Once Clubillion was confirmed as the owner of the database, we reached out to the developers. While awaiting a reply, we also contacted AWS with details of the leak. It was closed a few days later.
- Date discovered: 19th March 2020
- Date vendors contacted: 23rd March 2020
- Date of contact with AWS: 31st March 2020
- Date of Action: Approx. 5th April 2020
Example of Entries in the Database
Clubillion’s exposed database contained technical logs for millions of Clubillion users around the world, on both iOS and Android devices. Every time an individual player took any action on the app, a record was logged. Examples of records include:
- “enter game”
- “win”
- “lose”
- “update account”
- “create account”
During our investigation of the database, new entries continued to appear continuously. We estimated an average of approximately 200 million records per day – and sometimes, considerably more.
In total, this amounted to over 50GB of exposed records in the database every single day.
Within many of these records, were various forms of user Personally Identifiable Information (PII) data, including:
- IP addresses
- Email addresses
- Winnings
- Private messages
This data breach was truly global, with millions of records originating from Clubillion’s daily users all over the world. The following list is just a sample of countries affected, along with the average number of daily users from each country:
- USA – 10,000+
- UK – 2,475+
- France – 1,650+
- Israel – 408+
- Germany – 1,582+
- Spain – 1,026+
- Italy – 2,407+
- Netherlands – 622+
- Australia – 6,251+
- Canada – 7,792+
- Brazil – 3,859+
- Sweden – 191+
- Russia – 547+
Other countries affected included Uzbekistan, India, Poland, Romania, Vietnam, Lebanon, Indonesia, Philippines, Pakistan, Thailand, Austria, Hungry, and Latvia.
As you can see, on a single day, 10,000s of individual Clubillion players were exposed. Each one of these players could be targeted by malicious hackers for fraud and cyberattacks – along with millions more whose records were also contained in the database.
Data Breach Impact
Studies have shown that free gambling and gaming apps are especially prone to attacks and hacking from cybercriminals. They are routinely targeted for theft of private data and embedding malicious software on users’ devices.
Despite their popularity, gambling and casino apps often lack transparency, and it can be impossible to know what steps they’re taking to prevent cybercriminals successfully targeting their users.
One study of 23,000 free gambling apps found that: 3,200 posed a ‘moderate risk’ to users; 379 had known security vulnerabilities; 52 contained malicious software.
Any of these issues could be exploited to target app users in a wide range of frauds and cyberattacks, and Clubillion is no different.
With the exposed user PII and knowledge of their activity on the app, hackers could create elaborate schemes to defraud users. For example, some entries also included transaction errors for attempted card payments on Clubillion.
With the information in these transaction errors, hackers could target users with phishing campaigns, with the following aims:
- Trick them into providing their credit card details
- Trick them into providing additional PII to be used against them in further fraud
- Clicking a link that embeds malware, spyware, or ransomware onto their device.
If cybercriminals used Clubillion to embed malware or similar onto a user’s phone, they could potentially hack other apps, access files stored on the device, make calls, and send texts from the hacked device. They could even access a user’s phone contacts and steal the PII data of their friends and family.
Worse still, as people across the globe now find themselves under quarantine or self-isolation, as a result of the Coronavirus pandemic, the impact of a leak like this is potentially even more significant.
Clubillion stands to gain many new users, along with regular users playing more frequently. Hackers will be aware of this and looking for opportunities to exploit any vulnerabilities in the data security of such a massively popular app.
Had criminal hackers discovered Clubillion’s database, they could have targeted millions of people around the world, with devastating results.
Impact on Clubillion and it’s Developers
The most immediate risk for Clubillion is the loss of players. Data security is a growing concern for everyone these days, and this leak could turn many players off the app. Clubillion is not unique, and players have plenty of other choices for free gambling apps.
With fewer players, Clubillion will lose advertising revenue and reduced profits.
As many of Clubillion’s players reside within the EU, the app is under the jurisdiction of GDPR. The rules of GDPR also apply to apps, and Clubillion will need to take specific actions to ensure the regulatory body in charge doesn’t reprimand it.
Finally, Clubillion could also potentially be removed from Google Play and the App Store. Both Apple and Google are clamping down on apps that pose a risk to their users, removing apps embedded with malware, and taking data leaks much more seriously.
Each of these outcomes has a different likelihood of happening, but they would all negatively impact Clubillion’s revenue and business.
Advice from the Experts
Clubillion’s developers could have easily avoided this leak if they had taken some basic security measures to protect the database. These include, but are not limited to:
- Securing their servers.
- Implementing proper access rules.
- Never leaving a system that doesn’t require authentication open to the internet.
Any company can replicate the same steps, no matter its size.
For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.
For Clubillion Users
If you play on Clubillion and are concerned about how this breach might impact you, contact the app’s developers directly to find out what steps it’s taking to protect your data.
To learn about data vulnerabilities in general, read our complete guide to online privacy.
It shows you the many ways cybercriminals target internet users, and the steps you can take to stay safe.
How and Why We Discovered the Breach
The vpnMentor research team discovered the breach in Clubillion’s database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test different systems for weaknesses or vulnerabilities. They examine each weakness for any data being leaked.
Our team was able to access this database because it was completely unsecured and unencrypted.
Whenever we find a data breach, we use expert techniques to verify the owner of the database, usually a commercial company.
As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. We reached out to Clubillion’s developers, not only to let them know about the vulnerability but also to suggest ways in which they could make their system secure.
These ethics also mean we carry a responsibility to the public. Clubillion users must be aware of a data breach that exposes so much of their sensitive data.
The purpose of this web mapping project is to help make the internet safer for all users.
Latest News
Rivalry Reports Strong Q1 2025 KPI Growth, Validating Strategic Pivot Amid Temporary Margin Variance
Rivalry Corp. (TSXV: RVLY) (OTCQB: RVLCF) (“Rivalry” or the “Company”), the leading sportsbook and iGaming operator for digital-first players, today shared preliminary key performance indicators (“KPIs”) and revenue figures for the three months ended March 31, 2025 (“Q1 2025”), underscoring the success of its strategic transformation and path toward sustainable, profitable growth. All dollar figures are quoted in Canadian dollars.
Q1 2025 marks the first full quarter under Rivalry’s revamped operating model, following significant changes to product offerings, organizational structure, cost management, and user acquisition strategies. Underlying KPIs show improved unit economics, deeper engagement, and structural momentum toward long-term sustainability.
Revenue in the quarter was lower than prior periods – a result of Rivalry’s deliberate shift to a leaner, more efficient model – creating a stronger foundation that the Company is now building on. The shortfall also reflected temporary variance in sportsbook hold, amplified by a strategic focus on high-value and VIP players. The Company believes that these segments drive significantly greater long-term value but can introduce short-term volatility as they scale.
“Our Q1 KPIs are delivering tangible results that validate our strategic shift,” said Steven Salz, Co-Founder and CEO of Rivalry. “The structural changes we implemented over the past six months – from streamlining operations and refocusing the product, to modernizing our platform and concentrating on high-value players – are now clearly reflected in our KPIs. We’re operating more efficiently than ever, generating significantly more revenue per user, and moving closer to achieving sustainable profitability.”
Q1 2025 Highlights1:
- Operational Efficiency Up 400%: In Q1 2025, Rivalry generated over 400% more net revenue per user per dollar of operating expense as compared to its average before the strategic overhaul. This marks a significant leap in cost efficiency and operating leverage, validating the impact of recent changes.
- Shift to High-Value Players Driving 175% Increase in Player Monthly Deposits: Total deposits rose 36% month over month in February 2025 and another 12% in March 2025, despite a smaller active user base than past peaks. In Q1 2025, average monthly deposits per player were just over 175% higher than the periods prior to Rivalry’s October 2024 strategic overhaul – a clear result of the Company’s focus on acquiring and retaining high-value players, while improving unit economics and lowering variable costs.
- 115% Increase in Monthly Deposit Frequency: In Q1 2025, average monthly deposit frequency per player increased by 115% compared to the average prior to Rivalry’s October 2024 rebuild – signaling strong user re-engagement and validating the Company’s refined product experience and more targeted player strategy.
- All-Time High in Monthly Betting Handle per User: Monthly betting handle per active user hit a new all-time high in March 2025, marking the fifth consecutive month of record-breaking engagement and deeper player value.
- Record Revenue per User: In March 2025, monthly Gross and Net Revenue per active user reached all-time highs (normalized for margin variance), extending a four-month streak of consistent revenue per active user growth and player monetization strength.
- Month over Month Active User Growth: Monthly active players grew by 9% in March 2025, following a similar increase in February 2025, despite a significantly reduced global marketing budget compared to the same period last year.
- Ontario Regulated Market Showing Strong, Improving Unit Economics: Since the Company’s operational shift, Rivalry’s Average Revenue Per Playing Account (“ARPPA”) in Ontario – a monthly metric defined by and publicly reported by gaming regulator iGO – has generally trended in line with the market average, and in some months exceeded it by as much as 50%. ARPPA has also nearly doubled compared to pre-overhaul levels at Rivalry, reflecting strengthening unit economics supported by efficient customer acquisition, with customer acquisition cost paybacks consistently within single-digit weeks.
Operational Momentum and Efficiency Gains Reflect Structural Progress
The Company’s Q1 2025 performance reflects the first full quarter operating under a significantly leaner structure, with total monthly run rate operating expenses reduced by approximately 65% as compared to prior peak periods.
Betting handle in Q1 2025 was $58.2 million, and net revenue $1.3 million1, for a net revenue margin of 2.3%. This compares to Rivalry’s full-year 2024 net revenue margin of 4.4%1, with the Q1 2025 margin variance largely attributable to short-term fluctuations in sportsbook hold. This was amplified by the Company’s strategic pivot toward high-value and VIP players – segments that offer significantly greater long-term value but naturally introduce more short-term variability in margin performance as they scale.
On a normalized margin basis, Rivalry’s Q1 2025 net revenue would have covered approximately 75% of current run rate operating expenses, inclusive of additional cost reductions completed in early April that lowered monthly operating expenses by approximately $140,000. Growing user value, rising engagement, and stronger unit economics reflect encouraging momentum toward long-term financial sustainability.
“The KPIs are telling the real story – user value is up, efficiency is up, and player engagement is the strongest we’ve seen in the Company’s history,” said Steven Salz, Co-Founder and CEO of Rivalry. “Even with soft margin outcomes in Q1 2025, the model is showing strong underlying signals. As sportsbook hold normalizes and our cost base becomes leaner, we believe we’re moving in the right direction.”
Over the past six months, Rivalry has reduced monthly run rate operating expenses by approximately $1.7 million per month, inclusive of the recently completed April 2025 reductions. These reductions have been enabled by a fully modernized core product with improved site performance and ongoing development velocity across key revenue-driving features. The Company has also realized efficiencies through vendor rationalization and the rollout of AI-driven tools across departments.
“We’ve built a stronger, leaner, and more focused Rivalry,” Salz added. “Our improved KPIs and disciplined cost management have created a healthier foundation. With continued operational momentum and a re-energized product, we believe we’re on a promising path forward.”
The post Rivalry Reports Strong Q1 2025 KPI Growth, Validating Strategic Pivot Amid Temporary Margin Variance appeared first on Gaming and Gambling Industry in the Americas.
Bob Geschine
Todd Cravens Named President of Betson Gaming Division

H. Betti Industries Inc, the leading distributor of amusement and gaming equipment and parts, has announced the appointment of Todd Cravens as President of Betson Gaming. In this expanded leadership role, Cravens will oversee all aspects of its growing gaming division, with a focus on expanding market share, building the product portfolio, and accelerating growth in new and existing markets.
Since joining the Company in January 2025 as Senior Vice President of Gaming, Cravens has made an immediate and measurable impact across the business. His leadership has helped sharpen Betson’s gaming strategy, align the team, and focus on new revenue streams, while also bringing operational discipline and strategic vision to other areas of the company.
“Todd has quickly proven himself to be a dynamic and transformative leader and a key member of our senior Leadership team. In a short period of time, he’s elevated not just our gaming business but added value across the entire enterprise. We’re excited for what’s ahead as he takes this next step,” said Bob Geschine, President of H. Betti Industries.
With decades of experience in gaming and amusements, including prior roles as CEO of Galaxy Gaming and other executive leadership positions in the casino and amusement industries, Cravens brings a unique blend of industry expertise, customer focus, and entrepreneurial energy.
As President of Gaming, Cravens will focus on:
• Expanding Betson’s gaming footprint in key regulated markets
• Driving new product partnerships
• Leading legislative strategy for emerging markets
• Building a high-performance sales and service organization
• Enhancing Betson’s brand as a leader in both gaming and amusements
“The Betson name has a rich legacy in gaming and amusements, and I’m honored to lead our efforts to take that to the next level. This is a growth story — and we have a talented team, a great product portfolio, and a tremendous opportunity to grow our business and help our customers win,” said Cravens.
Cravens will continue to be based in Betson’s Henderson, Nevada office and will report directly to Bob Geschine, President of H. Betti Industries.
The post Todd Cravens Named President of Betson Gaming Division appeared first on Gaming and Gambling Industry in the Americas.
Compliance Updates
Nebraska: Proposal to Legalize Mobile Sports Betting Advances

Mobile online sports betting would be legal in Nebraska under a bill advancing in the Legislature, but trouble could still lie ahead for the proposal.
Sen. Eliot Bostar introduced the proposed state constitutional amendment that would let people make sports bets on their phone from anywhere in the state. Bostar says Nebraskans are already betting, either by going to a casino, a neighboring state or using illegal, unregulated platforms.
“I introduced this not because I think gambling is a great thing, not because I want everyone to do it, not because I think you should like it, or anyone should, but fundamentally because it’s already happening. Our prohibition on mobile sports betting here in save Nebraska is not stopping anyone from engaging in that activity,” Bostar said.
Sen. Jason Prokop has made the proposal his priority this session. Prokup talked about Nebraskans who cross the Mormon Bridge into Iowa and congregate at the first off I-680 to place bets during the football season.
“There’s no reason why a corn field in Iowa, just off the interstate, should be touted as the busiest corn field in America. Senators, those are your and my constituents using this product, spending their money and paying taxes in another state, simply because our Constitution does not provide for it,” he said.
Bostar said Nebraska is losing tax revenue.
“Nebraska is currently missing out on a $1.6 billion state online industry and $32 million in annual tax revenue, which instead goes to neighboring states like Iowa, Colorado, Kansas and Wyoming. Legalizing online mobile sports betting through LR20CA could significantly boost state revenues dedicated to the property tax credit fund, helping to address the burden of high property taxes,” he said.
Sen. Jared Storm seemed unmoved.
“I’ve been in the body for three months. I’m a freshman senator, and it seems like the common thread I keep seeing here is, if you want to pass your bill or get something through here, you say it’s going to lower property taxes. That’s kind of the buzz word,” he said.
Strong offered a different interpretation of any tax revenue.
“I would view this as taxation by exploitation. We’re going to exploit people to get tax revenue out of them, mainly young men. So you’re going to have students at UNL, students at UNK, other universities, who are going to gamble away their tuition on online sports betting. They’re going to gamble away their rent online sports gambling. I think as state senators, we have to stand up for those people,” he said.
Sen. Rob Clements read a letter from a mother whose son got in financial trouble from sports betting and died by suicide last year.
“The $10,000 bet my son frenetically placed on a losing NHL Stanley Cup game during the last 48 hours of his life, was followed by a series of still more frenetic bets placed in isolation on his phone as he tried to win back his massive loss. It is clear that he died alone,” Clements read.
But Sen. Ben Hansen argued incidents like that should not be enough to prohibit sports betting.
“How far do we restrict people’s liberties and their rights? This is always a tough one, because we do see some of the ills, the pitfalls some of our citizens can fall into. But do we take that right away from them for that reason? If we take away that right because of addictive factors, we better get rid of alcohol. We better get rid of smoking. We better get rid of refined sugar, one of the most addictive things that we legalize here in Nebraska. We better get rid of a lot of addictive behaviors in the state of Nebraska,” he said.
Sen. Rick Holdcroft read a letter from former Congressman Tom Osborne, former Gov. Kay Orr, Sen. Pete Ricketts and State Auditor Mike Foley opposing the proposal.
“Legalizing online sports betting in Nebraska would turn every cell phone, laptop and tablet into a gambling device available 24 by seven, online sports betting can lead to new people developing gambling disorders, puts young men in the addiction bulls eye and will take money away from the main street Nebraska businesses,” he said.
Gov. Jim Pillen has supported legalizing online sports betting in the past. And Sen. Tom Brandt said the proposal should be approved.
“In Nebraska, alcohol, tobacco, gambling, guns, whether you wear a helmet, we let grown ups decide that. We let our people decide that. Does everybody make a good decision? They do not. There are consequences to some bad decisions, but we let them decide for themselves. Mobile betting should be the same way,” he said.
But Sen. Brad von Gillern said mobile betting was an especially threatening form of gambling.
“My opposition to LR20CA is not from a moral position against gambling as a whole. I provided tons of data to you that illustrates that this is a predatory process that primarily pursues young men,” he said.
After about three hours of debate, senators voted 27-16 to give the bill first-round approval. But von Gillern vowed to filibuster it at the second round of debate, when opponents need only talk for four hours, instead of eight, before supporters can try to cut off debate and vote on the bill itself. That takes 33 votes, and von Gillern predicted it would be close.
The post Nebraska: Proposal to Legalize Mobile Sports Betting Advances appeared first on Gaming and Gambling Industry in the Americas.
-
gaming3 years ago
ODIN by 4Players: Immersive, state-of-the-art in-game audio launches into the next generation of gaming
-
EEG iGaming Directory8 years ago
iSoftBet continues to grow with new release Forest Mania
-
News7 years ago
Softbroke collaborates with Asia Live Tech for the expansion of the service line in the igaming market
-
News6 years ago
Super Bowl LIII: NFL Fans Can Bet on the #1 Sportsbook Review Site Betting-Super-Bowl.com, Providing Free Unbiased and Trusted News, Picks and Predictions
-
iGaming Industry7 years ago
Rick Meitzler appointed to the Indian Gaming Magazine Advisory Board for 2018
-
News6 years ago
REVEALED: Top eSports players set to earn $3.2 million in 2019
-
iGaming Industry7 years ago
French Senator raises Loot Boxes to France’s Gambling Regulator
-
News7 years ago
Exclusive Interview with Miklos Handa (Founder of the email marketing solutions, “MailMike.net”), speaker at Vienna International Gaming Expo 2018