Feeds

BET24 warns over data breach – 19 months later

Don't look back in anger, begs bookie

Reducing security risks from open source software

Update BET24.com warned customers on Monday that their personal data may have been exposed by a breach that took place in December 2009.

The gambling site is only warning clients 19 months after the breach, although it said it had taken other measures, including resetting passwords, at the time of the breach. The warning follows the arrest of a suspect found in "possession of unauthorised copies of personal customer information relating to various companies including BET24".

Data stolen from BET24 included customer names, addresses, email addresses, user account IDs, account passwords and encrypted payment card numbers. BET24 admitted that the stolen data had been used in instances of fraud on its site, at least, adding that victims had been reimbursed.

"The stolen information is so far known to have been used to access a limited number of customers' BET24 accounts, third-party accounts and personal email accounts," is said in a security notice. "A small number of customers have alerted us to unauthorised activity on their BET24 accounts and we have fully reimbursed them for any financial loss incurred on their accounts."

Hackers obtained the information after gaining access to BET24's database. The methods of the attack much less the perpetrators remain unclear. The gambling site said it is continuing to work with unnamed police authorities in their investigation into the breach.

BET24 said it had carried out a security audit following the breach. It also reset customer passwords of accounts registered before the end of October 2009, the only accounts exposed by the breach, early last year. It urges all customers to continue to monitor their bank and online gaming accounts for suspicious activity and to avoid the practice of using the same password on multiple sites. Most particularly long-established customers who used a BET24 password for their email account are encouraged to re-up their login credentials.

This advice comes very late in the day, 19 months after BET24 realised there might be a problem. "Bet24 will no doubt come under a lot of stick for both the breach of security and the delay in advising its customers," as specialist gambling site pokernewsreport.com notes.

Copies of the security notice that was sent to customers have also been posted by The Gambling Times here and on stayonpoker.com here.

El Reg contacted BET24. A spokesman told us:

We were told by our database manager in December 2009 that someone had made an illegal intrusion into the system but they had copied no data. We only knew of a limited number of breaches, which we handled on a case by case basis, where we advised and reimbursed the customers.

Very recently we were informed by police authorities that they have arrested third party individuals who were in possession of unauthorised copies of personal customer information relating to various companies including BET24.

We have been asked by the police not to disclose what country the investigation is taking place, due to the ongoing investigation, hence we can’t comment further on questions relating to this subject.

®

Bootnote

A hat-tip to Danish eCrime specialist Peter Kruse, who was among the first to report news of the BET24 breach.

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.