Sensitive data up for grabs
Lithuanian online betting website Orakulas, owned by operator OlyBet, has allegedly suffered a data breach, exposing the account information of more than 257,000 of its users.
now looking to sell the stolen data, including login details, email addresses, and hashed passwords
A user on popular hacking forum RaidForums is now looking to sell the stolen data, including login details, email addresses, and hashed passwords. A screenshot shared by the seller on Wednesday appeared to show a list of user emails with passwords partially revealed. The RaidForums account user, ‘0x1A4’, has asked for $100 in bitcoin for the information.
The same threat actor is hoping to exchange other Orakulas data for $1,500 in bitcoin. A pastebin link attached to the forum post suggests this second archive could contain much more sensitive information, such as customer IDs and credit card details.
How has OlyBet responded?
Gambling operator OlyBet is part of Olympic Entertainment Group. The company owns and operates several gambling businesses across Europe, including in the Baltic States, Slovakia, and Italy. Olympic purchased Lithuanian sports betting website Orakulas in 2015, subsequently merging it with the OlyBet brand.
We, as OlyBet, do not know what information has leaked online”
Lithuanian news site 15 Minutes contacted OlyBet to inquire about the data breach. The company said it had not experienced a hack since it took over control of Orakulas six years ago. Tomas Palevičius, CEO of OlyBet said: “We, as OlyBet, do not know what information has leaked online, because it is not our database, not OlyBet’s, but Oracle’s database, which no longer exists as a company.” The executive affirmed the safety of the operator’s customer data.
Within the forum message bar accompanying the sale listing, the data seller said Orakulas suffered several leaks of user information from 2015 to 2018. However, Rytis Rainys, the head of the National Cyber Security Center in Lithuania, said the body had no record of an Orakulas data breach.
Other major data leaks
Orakulas is not the only gambling company to have suffered at the hands of hackers. Over the course of 2020, a number of operators experienced data breaches.
Last February, hackers exposed the personal details of 10.6 million MGM Resorts International customers. The data breach concerned information from guests at one of the company’s hotels and included the personal details of Twitter founder Jack Dorsey and pop star Justin Bieber. The hack exposed full names, addresses, email addresses, and phone numbers of the MGM customers.
The same year, a crypto-ransomware group known as Maze hacked sportsbook operator BetUS. The group breached BetUS’s internal data, including minutes from board meetings and passport scans from company executives. To prevent data exposure, Maze demanded the sportsbook operator to pay an undisclosed fee in bitcoin.