Connect with us

Latest News

Popular Gambling App Exposed Millions of Users in Massive Data Leak

Published

5 years ago

on

Reading Time: 5 minutes

 

Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a data breach on casino gambling app Clubillion.

The breach originated in a technical database built on an Elasticsearch engine and was recording the daily activities of millions of Clubillion players around the world.

Aside from leaking activity on the app, the breached database also exposed private user information.

With this information publicly available, Clubillion’s users were vulnerable to fraud and various online attacks with potentially devastating results.

Company Profile

Clubillion is a free online casino game available for iOS and Android, offering players 30+ free slot games. While each app is listed under a different developer – Ouroboros on iOS and T7 Games on Android – these are most likely owned by the same company.

Both versions of Clubillion were released in 2019 and became instant hits. Each is now ranked the #1 ‘social slots’ casino app on Google Play and the App Store, with a 4.8 star on both.

Timeline of Discovery and Owner Reaction

Sometimes, the extent of a data breach and the owner of the database are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data.

Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness.

Some affected parties deny the facts, disregarding our research, or playing down its impact. So, we need to be thorough and make sure everything we find is correct and accurate.

In this case, the database was built on Elasticsearch and hosted on Amazon Web Services (AWS), with Clubillion’s name on its apps, and links to assets owned by the company.

Once Clubillion was confirmed as the owner of the database, we reached out to the developers. While awaiting a reply, we also contacted AWS with details of the leak. It was closed a few days later.

  • Date discovered: 19th March 2020
  • Date vendors contacted: 23rd March 2020
  • Date of contact with AWS: 31st March 2020
  • Date of Action: Approx. 5th April 2020

Example of Entries in the Database

Clubillion’s exposed database contained technical logs for millions of Clubillion users around the world, on both iOS and Android devices. Every time an individual player took any action on the app, a record was logged. Examples of records include:

  • “enter game”
  • “win”
  • “lose”
  • “update account”
  • “create account”

During our investigation of the database, new entries continued to appear continuously. We estimated an average of approximately 200 million records per day – and sometimes, considerably more.

In total, this amounted to over 50GB of exposed records in the database every single day.

Within many of these records, were various forms of user Personally Identifiable Information (PII) data, including:

  • IP addresses
  • Email addresses
  • Winnings
  • Private messages

This data breach was truly global, with millions of records originating from Clubillion’s daily users all over the world. The following list is just a sample of countries affected, along with the average number of daily users from each country:

  • USA – 10,000+
  • UK – 2,475+
  • France – 1,650+
  • Israel – 408+
  • Germany – 1,582+
  • Spain – 1,026+
  • Italy – 2,407+
  • Netherlands – 622+
  • Australia – 6,251+
  • Canada – 7,792+
  • Brazil – 3,859+
  • Sweden – 191+
  • Russia – 547+

Other countries affected included Uzbekistan, India, Poland, Romania, Vietnam, Lebanon, Indonesia, Philippines, Pakistan, Thailand, Austria, Hungry, and Latvia.

As you can see, on a single day, 10,000s of individual Clubillion players were exposed. Each one of these players could be targeted by malicious hackers for fraud and cyberattacks – along with millions more whose records were also contained in the database.

Data Breach Impact

Studies have shown that free gambling and gaming apps are especially prone to attacks and hacking from cybercriminals. They are routinely targeted for theft of private data and embedding malicious software on users’ devices.

Despite their popularity, gambling and casino apps often lack transparency, and it can be impossible to know what steps they’re taking to prevent cybercriminals successfully targeting their users.

One study of 23,000 free gambling apps found that: 3,200 posed a ‘moderate risk’ to users; 379 had known security vulnerabilities; 52 contained malicious software.

Any of these issues could be exploited to target app users in a wide range of frauds and cyberattacks, and Clubillion is no different.

With the exposed user PII and knowledge of their activity on the app, hackers could create elaborate schemes to defraud users. For example, some entries also included transaction errors for attempted card payments on Clubillion.

With the information in these transaction errors, hackers could target users with phishing campaigns, with the following aims:

  1. Trick them into providing their credit card details
  2. Trick them into providing additional PII to be used against them in further fraud
  3. Clicking a link that embeds malware, spyware, or ransomware onto their device.

If cybercriminals used Clubillion to embed malware or similar onto a user’s phone, they could potentially hack other apps, access files stored on the device, make calls, and send texts from the hacked device. They could even access a user’s phone contacts and steal the PII data of their friends and family.

Worse still, as people across the globe now find themselves under quarantine or self-isolation, as a result of the Coronavirus pandemic, the impact of a leak like this is potentially even more significant.

Clubillion stands to gain many new users, along with regular users playing more frequently. Hackers will be aware of this and looking for opportunities to exploit any vulnerabilities in the data security of such a massively popular app.

Had criminal hackers discovered Clubillion’s database, they could have targeted millions of people around the world, with devastating results.

Impact on Clubillion and it’s Developers

The most immediate risk for Clubillion is the loss of players. Data security is a growing concern for everyone these days, and this leak could turn many players off the app. Clubillion is not unique, and players have plenty of other choices for free gambling apps.

With fewer players, Clubillion will lose advertising revenue and reduced profits.

As many of Clubillion’s players reside within the EU, the app is under the jurisdiction of GDPR. The rules of GDPR also apply to apps, and Clubillion will need to take specific actions to ensure the regulatory body in charge doesn’t reprimand it.

Finally, Clubillion could also potentially be removed from Google Play and the App Store. Both Apple and Google are clamping down on apps that pose a risk to their users, removing apps embedded with malware, and taking data leaks much more seriously.

Each of these outcomes has a different likelihood of happening, but they would all negatively impact Clubillion’s revenue and business.

Advice from the Experts

Clubillion’s developers could have easily avoided this leak if they had taken some basic security measures to protect the database. These include, but are not limited to:

  1. Securing their servers.
  2. Implementing proper access rules.
  3. Never leaving a system that doesn’t require authentication open to the internet.

Any company can replicate the same steps, no matter its size.

For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.

For Clubillion Users

If you play on Clubillion and are concerned about how this breach might impact you, contact the app’s developers directly to find out what steps it’s taking to protect your data.

To learn about data vulnerabilities in general, read our complete guide to online privacy.

It shows you the many ways cybercriminals target internet users, and the steps you can take to stay safe.

How and Why We Discovered the Breach

The vpnMentor research team discovered the breach in Clubillion’s database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test different systems for weaknesses or vulnerabilities. They examine each weakness for any data being leaked.

Our team was able to access this database because it was completely unsecured and unencrypted. 

Whenever we find a data breach, we use expert techniques to verify the owner of the database, usually a commercial company.

As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. We reached out to Clubillion’s developers, not only to let them know about the vulnerability but also to suggest ways in which they could make their system secure.

These ethics also mean we carry a responsibility to the public. Clubillion users must be aware of a data breach that exposes so much of their sensitive data.

The purpose of this web mapping project is to help make the internet safer for all users.

 

Source

Related Topics:
Continue Reading
Advertisement

Latest News

BetHog Chooses Optimove as its Marketing Solution through Ignite+ Program to Jumpstart its Marketing

Published

4 hours ago

on

August 25, 2025

By

bethog-chooses-optimove-as-its-marketing-solution-through-ignite+-program-to-jumpstart-its-marketing

 

Cryptocurrency casino and sportsbook startup harnesses Optimove’s Ignite+ Program to scale campaigns, gain predictive insights, and deliver personalized player journeys at scale

BetHog, a cryptocurrency casino and sportsbook from the creators of FanDuel, has chosen Optimove as its marketing solution through its Ignite+ program. Ignite+ gives BetHog access to enterprise-grade CRM and AI-driven marketing capabilities, enabling the company to accelerate campaign execution, gain predictive insights, and deliver more personalized player experiences at scale. Optimove is the creator of Positionless Marketing and the #1 Marketing Solution for iGaming and sports betting operators.

“Optimove has been an incredible platform and partner in speed-to-market from day one,” said Kyle Wachtel, Chief Marketing Officer at BetHog. “Their team didn’t just provide us with a platform. They became an extension of our marketing team, bringing expertise, predictive models, and industry knowledge that we simply couldn’t replicate in-house at this stage.”

Tomer Imber, Senior Director of Sales, US Gaming at Optimove, commented: “From the start, the BetHog team has shown incredible vision and drive, already boasting an innovative product and burgeoning brand, and we are excited to be part of their journey. BetHog is leveraging our platform to build lasting player relationships and accelerate growth.”

The partnership highlights BetHog’s rapid path from integration to execution. Within weeks, the company completed its IP warmup, validated data quality, and began sending campaigns. Optimove’s out-of-the-box predictive models and churn analytics now serve as a BI function for the startup, enabling it to focus on growth without the burden of building a large internal team.

“The Ignite+ Program was the perfect fit for us as a fast-growing startup,” Wachtel added. “It gave us access to enterprise-grade CRM capabilities and AI-driven insights without the overhead of building out a full BI and CRM function. From onboarding to campaign launch, Optimove executed at startup speed to get us live.”
With Optimove in place, BetHog is now poised to embrace Positionless Marketing, a breakthrough approach that frees marketers from traditional role constraints and gives them the ability to independently harness Data Power, Creative Power, and Optimization Power.

“We still have many opportunities to explore with Optimove, and we are confident that Positionless Marketing will help us move faster, personalize more deeply, and maximize every player interaction,” Wachtel said.

The Ignite+ Program has already supported the growth of dozens of iGaming and sportsbook operators. For BetHog, leveraging Ignite+ represents a key milestone in its journey to scale rapidly while building a foundation for personalized, AI-powered marketing.

 

The post BetHog Chooses Optimove as its Marketing Solution through Ignite+ Program to Jumpstart its Marketing appeared first on Gaming and Gambling Industry in the Americas.

Continue Reading

Latest News

VSiN Launches Fall Programming Lineup, Giving Fans More of Their Favorite Sports Betting Shows and Hosts

Published

4 hours ago

on

August 25, 2025

By

vsin-launches-fall-programming-lineup,-giving-fans-more-of-their-favorite-sports-betting-shows-and-hosts

 

Sports Betting Network Adds Hour of Sharp Bettor Favorite “A Numbers Game,” Announces Hosts Mitch Moss & Pauly Howard Join Sunday Programming, Sees Return of Fantasy Sports “Guru” John Hansen

VSiN, The Sports Betting Network, announces its new programming lineup, delivering more of the network’s most popular sports betting shows and hosts. As the 2025 NFL season ramps up, VSiN’s new fall schedule launches to the largest audience in its history.

“With more viewers and listeners than we’ve ever had going into football season, we’re thrilled to launch VSiN’s new programming lineup as an answer to fans asking for more of the quality programming they want and need to inform their wagering and fantasy decisions,” said Steve Cohen, EVP of Talent and Programming at VSiN. “As our competitors across all media continue to pull back and even disappear, it’s that continued commitment to content that sets VSiN apart and fuels our continued growth.”

VSiN’s full live programming lineup launches today and can be viewed at VSiN.com. Highlights include:

  • VSiN adds one additional hour to “A Numbers Game” with Gill Alexander and producer Kelley Bydlon. The longest running show on VSiN now airs weekdays from 10 a.m. – 1 p.m. ET. Each day, Alexander and his roster of expert guests take fans deep into the numbers of gambling, leveraging advanced metrics in his handicapping.
  • Hosts of VSiN’s popular weekday afternoon show “Follow the Money,” Mitch Moss and Pauly Howard, will add a sixth shift each week to anchor the live NFL pregame discussion on “VSiN’s Pro Football Tailgate Show” Sundays from 9 a.m. – noon ET. Analytics expert Warren Sharp and props analyst John Hansen will be among the regular guests. Having moved the show’s weekday timeslot from mornings to afternoons last fall, Moss and Howard return to mornings one day each week for the Sunday football action.
  • “The Guru” John Hansen returns as the host of “Prop Points,” bringing decades of fantasy expertise to weekdays from 1 p.m. to 2 p.m. ET. Hansen has been an industry leader since 1995. He was the first individual to contribute to ESPN’s coverage of fantasy football online and on ESPN Radio and TV in 1996, before roles at Yahoo! Sports, “NFL Fantasy Live” on NFL.com, and as chief fantasy analyst for a ground-breaking “Fantasy Zone” channel on DirectTV.
  • The popular Circa Friday Football Invitational show, hosted by Matt Youmans, returns for a third season. Twenty-five pro bettors and handicappers compete in a weekly pro and college football pick’em contest for $30,000 in prizes. The show will be expanded by an hour, from 7 p.m. – 10 p.m. ET.
  • VSiN’s own Dustin Swedelson takes the anchor desk permanently on “Cashing Out,” the network’s last live show and the final word on the day’s betting action. Each weeknight from 11 p.m. – 2 a.m. ET, Swedelson savors the wins, analyzes the losses and sets the board for tomorrow’s betting menu.
  • “VSiN by the Books” has moved its home base to VSiN’s new studio in Circa Sports sportsbook located at The Mint Gaming Hall Kentucky Downs in Franklin. The morning show and some Saturday programming will broadcast live from the recently launched retail sportsbook, which is the largest in the state of Kentucky.
  • Beginning on Saturday, Aug. 30, VSiN’s weekend programming will start an hour earlier at 9 a.m. ET to deliver all the news, analysis and insights sports fans and betting enthusiasts need on gameday.

Broadcasting 24/7 from the entertainment capital of the world in Las Vegas, VSiN empowers sports fans and bettors with the news, analysis, and insights they need to make informed wagering decisions, including 18+ hours of daily live linear sports content. Featuring some of the industry’s most knowledgeable sports betting and fantasy experts, as well as legendary book makers, VSiN’s goal is to inform and entertain the growing number of Americans betting on sports – whether they are sharp bettors or brand new to sports betting. VSiN’s exclusive content sets the stage for the day’s biggest sports betting events and includes expert tips and predictions on college and pro football, college and pro basketball, baseball, hockey, golf, tennis, NASCAR, and more.

Fans can access VSiN content on YouTube TV, SiriusXM (158), Rogers’ Sportsnet, NESN, Marquee Sports Network, MASN, Spectrum SportsNet LA, SportsNet Pittsburgh, iHeartRadio, TuneIn, more than 350 terrestrial radio stations throughout the U.S., VSiN.com, and the VSiN Watch app.

VSiN’s newsroom studio is located in the sportsbook at the Circa Resort and Casino in Las Vegas.

 

The post VSiN Launches Fall Programming Lineup, Giving Fans More of Their Favorite Sports Betting Shows and Hosts appeared first on Gaming and Gambling Industry in the Americas.

Continue Reading

Latest News

Fast Track AI to change the face of iGaming CRM

Published

4 hours ago

on

August 25, 2025

By

fast-track-ai-to-change-the-face-of-igaming-crm

 

Fast Track will unveil its new AI-driven natural language platform on 2 September during its annual Fast Track House event in Malta. The launch will also be streamed live online from 4 PM CEST, giving the iGaming industry an exclusive first look at the future of player engagement.

For the past decade, Fast Track has pioneered real-time data integration, the Singularity Model, the only Gameplay Risk Engine, and Rewards, the first AI-ready gamification system. Each innovation has moved the company closer to its vision: to digitalise the iGaming industry and deliver the first self-learning engagement platform.

Fast Track AI is trained on over 10 years of iGaming expertise and designed to transform how CRM teams work. It can perform technical analysis on terabytes of real-time data, deliver advanced insights into CRM performance and player behaviour, and uniquely take direct action on those insights across the platform.

“This isn’t just AI added to CRM. This is CRM re-engineered for the natural language era,” said Simon Lidzén, CEO and Co-Founder of Fast Track.

“Even your wildest imagination can only take you so far; minds have been bound by constraints for so long that it is hard to picture the full power of Fast Track AI. You simply need to see it to believe it. This is why I am organising a live session to unveil it; to showcase what a native iGaming CRM, built on the most comprehensive real-time data infrastructure together with the Singularity Model, is capable of. I urge the whole industry to sign up.” Lidzén added.

The big reveal will take place during the Fast Track House event in Malta and will be streamed live online. The broadcast begins at 4:00 PM CEST on 2 September. 

Registration is now open: https://app.livestorm.co/fast-track/fast-track-ai-in-action

 

The post Fast Track AI to change the face of iGaming CRM appeared first on Gaming and Gambling Industry in the Americas.

Continue Reading

Trending