Feeds

BET24 warns over data breach – 19 months later

Don't look back in anger, begs bookie

Remote control for virtualized desktops

Update BET24.com warned customers on Monday that their personal data may have been exposed by a breach that took place in December 2009.

The gambling site is only warning clients 19 months after the breach, although it said it had taken other measures, including resetting passwords, at the time of the breach. The warning follows the arrest of a suspect found in "possession of unauthorised copies of personal customer information relating to various companies including BET24".

Data stolen from BET24 included customer names, addresses, email addresses, user account IDs, account passwords and encrypted payment card numbers. BET24 admitted that the stolen data had been used in instances of fraud on its site, at least, adding that victims had been reimbursed.

"The stolen information is so far known to have been used to access a limited number of customers' BET24 accounts, third-party accounts and personal email accounts," is said in a security notice. "A small number of customers have alerted us to unauthorised activity on their BET24 accounts and we have fully reimbursed them for any financial loss incurred on their accounts."

Hackers obtained the information after gaining access to BET24's database. The methods of the attack much less the perpetrators remain unclear. The gambling site said it is continuing to work with unnamed police authorities in their investigation into the breach.

BET24 said it had carried out a security audit following the breach. It also reset customer passwords of accounts registered before the end of October 2009, the only accounts exposed by the breach, early last year. It urges all customers to continue to monitor their bank and online gaming accounts for suspicious activity and to avoid the practice of using the same password on multiple sites. Most particularly long-established customers who used a BET24 password for their email account are encouraged to re-up their login credentials.

This advice comes very late in the day, 19 months after BET24 realised there might be a problem. "Bet24 will no doubt come under a lot of stick for both the breach of security and the delay in advising its customers," as specialist gambling site pokernewsreport.com notes.

Copies of the security notice that was sent to customers have also been posted by The Gambling Times here and on stayonpoker.com here.

El Reg contacted BET24. A spokesman told us:

We were told by our database manager in December 2009 that someone had made an illegal intrusion into the system but they had copied no data. We only knew of a limited number of breaches, which we handled on a case by case basis, where we advised and reimbursed the customers.

Very recently we were informed by police authorities that they have arrested third party individuals who were in possession of unauthorised copies of personal customer information relating to various companies including BET24.

We have been asked by the police not to disclose what country the investigation is taking place, due to the ongoing investigation, hence we can’t comment further on questions relating to this subject.

®

Bootnote

A hat-tip to Danish eCrime specialist Peter Kruse, who was among the first to report news of the BET24 breach.

Remote control for virtualized desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?