Feeds

BET24 warns over data breach – 19 months later

Don't look back in anger, begs bookie

Next gen security for virtualised datacentres

Update BET24.com warned customers on Monday that their personal data may have been exposed by a breach that took place in December 2009.

The gambling site is only warning clients 19 months after the breach, although it said it had taken other measures, including resetting passwords, at the time of the breach. The warning follows the arrest of a suspect found in "possession of unauthorised copies of personal customer information relating to various companies including BET24".

Data stolen from BET24 included customer names, addresses, email addresses, user account IDs, account passwords and encrypted payment card numbers. BET24 admitted that the stolen data had been used in instances of fraud on its site, at least, adding that victims had been reimbursed.

"The stolen information is so far known to have been used to access a limited number of customers' BET24 accounts, third-party accounts and personal email accounts," is said in a security notice. "A small number of customers have alerted us to unauthorised activity on their BET24 accounts and we have fully reimbursed them for any financial loss incurred on their accounts."

Hackers obtained the information after gaining access to BET24's database. The methods of the attack much less the perpetrators remain unclear. The gambling site said it is continuing to work with unnamed police authorities in their investigation into the breach.

BET24 said it had carried out a security audit following the breach. It also reset customer passwords of accounts registered before the end of October 2009, the only accounts exposed by the breach, early last year. It urges all customers to continue to monitor their bank and online gaming accounts for suspicious activity and to avoid the practice of using the same password on multiple sites. Most particularly long-established customers who used a BET24 password for their email account are encouraged to re-up their login credentials.

This advice comes very late in the day, 19 months after BET24 realised there might be a problem. "Bet24 will no doubt come under a lot of stick for both the breach of security and the delay in advising its customers," as specialist gambling site pokernewsreport.com notes.

Copies of the security notice that was sent to customers have also been posted by The Gambling Times here and on stayonpoker.com here.

El Reg contacted BET24. A spokesman told us:

We were told by our database manager in December 2009 that someone had made an illegal intrusion into the system but they had copied no data. We only knew of a limited number of breaches, which we handled on a case by case basis, where we advised and reimbursed the customers.

Very recently we were informed by police authorities that they have arrested third party individuals who were in possession of unauthorised copies of personal customer information relating to various companies including BET24.

We have been asked by the police not to disclose what country the investigation is taking place, due to the ongoing investigation, hence we can’t comment further on questions relating to this subject.

®

Bootnote

A hat-tip to Danish eCrime specialist Peter Kruse, who was among the first to report news of the BET24 breach.

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.