Feeds

BET24 warns over data breach – 19 months later

Don't look back in anger, begs bookie

Top three mobile application threats

Update BET24.com warned customers on Monday that their personal data may have been exposed by a breach that took place in December 2009.

The gambling site is only warning clients 19 months after the breach, although it said it had taken other measures, including resetting passwords, at the time of the breach. The warning follows the arrest of a suspect found in "possession of unauthorised copies of personal customer information relating to various companies including BET24".

Data stolen from BET24 included customer names, addresses, email addresses, user account IDs, account passwords and encrypted payment card numbers. BET24 admitted that the stolen data had been used in instances of fraud on its site, at least, adding that victims had been reimbursed.

"The stolen information is so far known to have been used to access a limited number of customers' BET24 accounts, third-party accounts and personal email accounts," is said in a security notice. "A small number of customers have alerted us to unauthorised activity on their BET24 accounts and we have fully reimbursed them for any financial loss incurred on their accounts."

Hackers obtained the information after gaining access to BET24's database. The methods of the attack much less the perpetrators remain unclear. The gambling site said it is continuing to work with unnamed police authorities in their investigation into the breach.

BET24 said it had carried out a security audit following the breach. It also reset customer passwords of accounts registered before the end of October 2009, the only accounts exposed by the breach, early last year. It urges all customers to continue to monitor their bank and online gaming accounts for suspicious activity and to avoid the practice of using the same password on multiple sites. Most particularly long-established customers who used a BET24 password for their email account are encouraged to re-up their login credentials.

This advice comes very late in the day, 19 months after BET24 realised there might be a problem. "Bet24 will no doubt come under a lot of stick for both the breach of security and the delay in advising its customers," as specialist gambling site pokernewsreport.com notes.

Copies of the security notice that was sent to customers have also been posted by The Gambling Times here and on stayonpoker.com here.

El Reg contacted BET24. A spokesman told us:

We were told by our database manager in December 2009 that someone had made an illegal intrusion into the system but they had copied no data. We only knew of a limited number of breaches, which we handled on a case by case basis, where we advised and reimbursed the customers.

Very recently we were informed by police authorities that they have arrested third party individuals who were in possession of unauthorised copies of personal customer information relating to various companies including BET24.

We have been asked by the police not to disclose what country the investigation is taking place, due to the ongoing investigation, hence we can’t comment further on questions relating to this subject.

®

Bootnote

A hat-tip to Danish eCrime specialist Peter Kruse, who was among the first to report news of the BET24 breach.

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.