Latest News

Popular Gambling App Exposed Millions of Users in Massive Data Leak

Published

5 years ago

July 8, 2020

Reading Time: 5 minutes

Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a data breach on casino gambling app Clubillion.

The breach originated in a technical database built on an Elasticsearch engine and was recording the daily activities of millions of Clubillion players around the world.

Aside from leaking activity on the app, the breached database also exposed private user information.

European Gaming Congress 2024 (Warsaw, Poland)

With this information publicly available, Clubillion’s users were vulnerable to fraud and various online attacks with potentially devastating results.

Company Profile

Clubillion is a free online casino game available for iOS and Android, offering players 30+ free slot games. While each app is listed under a different developer – Ouroboros on iOS and T7 Games on Android – these are most likely owned by the same company.

Both versions of Clubillion were released in 2019 and became instant hits. Each is now ranked the #1 ‘social slots’ casino app on Google Play and the App Store, with a 4.8 star on both.

Timeline of Discovery and Owner Reaction

Sometimes, the extent of a data breach and the owner of the database are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data.

Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness.

Some affected parties deny the facts, disregarding our research, or playing down its impact. So, we need to be thorough and make sure everything we find is correct and accurate.

In this case, the database was built on Elasticsearch and hosted on Amazon Web Services (AWS), with Clubillion’s name on its apps, and links to assets owned by the company.

Once Clubillion was confirmed as the owner of the database, we reached out to the developers. While awaiting a reply, we also contacted AWS with details of the leak. It was closed a few days later.

Date discovered: 19th March 2020

Date vendors contacted: 23rd March 2020

Date of contact with AWS: 31st March 2020

Date of Action: Approx. 5th April 2020

Example of Entries in the Database

Clubillion’s exposed database contained technical logs for millions of Clubillion users around the world, on both iOS and Android devices. Every time an individual player took any action on the app, a record was logged. Examples of records include:

“enter game”
“win”
“lose”
“update account”
“create account”

During our investigation of the database, new entries continued to appear continuously. We estimated an average of approximately 200 million records per day – and sometimes, considerably more.

In total, this amounted to over 50GB of exposed records in the database every single day.

Within many of these records, were various forms of user Personally Identifiable Information (PII) data, including:

IP addresses
Email addresses
Winnings
Private messages

This data breach was truly global, with millions of records originating from Clubillion’s daily users all over the world. The following list is just a sample of countries affected, along with the average number of daily users from each country:

USA – 10,000+
UK – 2,475+
France – 1,650+
Israel – 408+
Germany – 1,582+
Spain – 1,026+
Italy – 2,407+
Netherlands – 622+
Australia – 6,251+
Canada – 7,792+
Brazil – 3,859+
Sweden – 191+
Russia – 547+

Other countries affected included Uzbekistan, India, Poland, Romania, Vietnam, Lebanon, Indonesia, Philippines, Pakistan, Thailand, Austria, Hungry, and Latvia.

As you can see, on a single day, 10,000s of individual Clubillion players were exposed. Each one of these players could be targeted by malicious hackers for fraud and cyberattacks – along with millions more whose records were also contained in the database.

Data Breach Impact

Studies have shown that free gambling and gaming apps are especially prone to attacks and hacking from cybercriminals. They are routinely targeted for theft of private data and embedding malicious software on users’ devices.

Despite their popularity, gambling and casino apps often lack transparency, and it can be impossible to know what steps they’re taking to prevent cybercriminals successfully targeting their users.

One study of 23,000 free gambling apps found that: 3,200 posed a ‘moderate risk’ to users; 379 had known security vulnerabilities; 52 contained malicious software.

Any of these issues could be exploited to target app users in a wide range of frauds and cyberattacks, and Clubillion is no different.

With the exposed user PII and knowledge of their activity on the app, hackers could create elaborate schemes to defraud users. For example, some entries also included transaction errors for attempted card payments on Clubillion.

With the information in these transaction errors, hackers could target users with phishing campaigns, with the following aims:

Trick them into providing their credit card details
Trick them into providing additional PII to be used against them in further fraud
Clicking a link that embeds malware, spyware, or ransomware onto their device.

If cybercriminals used Clubillion to embed malware or similar onto a user’s phone, they could potentially hack other apps, access files stored on the device, make calls, and send texts from the hacked device. They could even access a user’s phone contacts and steal the PII data of their friends and family.

Worse still, as people across the globe now find themselves under quarantine or self-isolation, as a result of the Coronavirus pandemic, the impact of a leak like this is potentially even more significant.

Clubillion stands to gain many new users, along with regular users playing more frequently. Hackers will be aware of this and looking for opportunities to exploit any vulnerabilities in the data security of such a massively popular app.

Had criminal hackers discovered Clubillion’s database, they could have targeted millions of people around the world, with devastating results.

Impact on Clubillion and it’s Developers

The most immediate risk for Clubillion is the loss of players. Data security is a growing concern for everyone these days, and this leak could turn many players off the app. Clubillion is not unique, and players have plenty of other choices for free gambling apps.

With fewer players, Clubillion will lose advertising revenue and reduced profits.

As many of Clubillion’s players reside within the EU, the app is under the jurisdiction of GDPR. The rules of GDPR also apply to apps, and Clubillion will need to take specific actions to ensure the regulatory body in charge doesn’t reprimand it.

Finally, Clubillion could also potentially be removed from Google Play and the App Store. Both Apple and Google are clamping down on apps that pose a risk to their users, removing apps embedded with malware, and taking data leaks much more seriously.

Each of these outcomes has a different likelihood of happening, but they would all negatively impact Clubillion’s revenue and business.

Advice from the Experts

Clubillion’s developers could have easily avoided this leak if they had taken some basic security measures to protect the database. These include, but are not limited to:

Securing their servers.
Implementing proper access rules.
Never leaving a system that doesn’t require authentication open to the internet.

Any company can replicate the same steps, no matter its size.

For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.

For Clubillion Users

If you play on Clubillion and are concerned about how this breach might impact you, contact the app’s developers directly to find out what steps it’s taking to protect your data.

To learn about data vulnerabilities in general, read our complete guide to online privacy.

It shows you the many ways cybercriminals target internet users, and the steps you can take to stay safe.

How and Why We Discovered the Breach

The vpnMentor research team discovered the breach in Clubillion’s database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test different systems for weaknesses or vulnerabilities. They examine each weakness for any data being leaked.

Our team was able to access this database because it was completely unsecured and unencrypted.

Whenever we find a data breach, we use expert techniques to verify the owner of the database, usually a commercial company.

As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. We reached out to Clubillion’s developers, not only to let them know about the vulnerability but also to suggest ways in which they could make their system secure.

These ethics also mean we carry a responsibility to the public. Clubillion users must be aware of a data breach that exposes so much of their sensitive data.

The purpose of this web mapping project is to help make the internet safer for all users.

Source

iGaming

The LATAM Online Casino Market: Where Innovation Meets Localization

Published

38 seconds ago

June 18, 2025

GamingAmericas.com

the-latam-online-casino-market:-where-innovation-meets-localization

Latin America, or LATAM, is quickly rising on the global radar as a hot new playground for online casinos. A lively mixture of tech-hungry young people, wider Internet access every month, and rules that are slowly but steadily growing friendlier to gaming makes the region a tempting patch of soil for operators eager to plant their brand. Unlike older markets that are already crowded and tightening the regulatory screws, LATAM still feels fresh and open, letting companies chase fast gains by leaning on bold ideas, local flavors, and mobile-first thinking.

Why LATAM Is a Key Growth Market for Online Gambling

A few key trends are stacking the deck in favor of LATAM casinos. First, smartphones have practically become a third arm for many residents. The GSMA Mobile Economy report for 2023 says more than 73 percent of the region now carries a smartphone, and that share keeps climbing. Such broad pocket-sized connectivity lets gaming sites reach players, even in remote towns, without the extra cost of shops or kiosks.

Second, LATAM’s population is much younger than Europe or North America. Millennials and Gen Z together make up a huge slice of the online betting crowd. Because these generations live, shop, and play through apps, they slide into digital payments and gamified screens with little friction, exactly the kind of audience casinos dream about.

Third, even though rules still differ from nation to nation, the general trend is toward looser, friendlier legislation. Brazil, for example, just passed a law covering fixed-odds sports betting and other online games, a clear sign that officials want licensed, taxable sites.

For LATAM players who prefer local touches, a one-stop hub such as Ingamble proves useful. The service directs users to casinos in their language, accepts their usual payment methods, and meets local laws, building the trust and ease that a young market needs.

How Cultural Differences Shape Casino Preferences

Grasping what people like in each country is critical to success, and LATAM shows that well. Its mix of cultures, customs, and histories means a blanket offer will disappoint in most places. In Mexico, for instance, community bingo nights and brightly themed slots still rule the floor, echoing deep traditions. Developers win by weaving folkloric images, regional music, and familiar tales into those games.

Brazilians, by contrast, look for platforms that merge casino fun with sports betting heat. Because football is almost a second religion, sites that serve live odds alongside a spinning wheel or table gain a clear and lasting advantage.

Localizing a product goes well beyond swapping English words for Spanish or Portuguese. It means building every step of the user journey around local holidays, favorite sports, and even the colors people associate with luck. When a digital service reflects the rhythm of daily life in a country, users stay longer and come back more often.

LATAM’s payments landscape is fragmented, so every casino must meet players where they are. Many customers are underbanked or lean on alternative tools, which makes integrating local methods essential rather than optional. Accepting Brazil’s PIX or the classic boleto bancario has moved from a bonus feature to a bare minimum.

Across the region, Argentina’s Mercado Pago rules wallets while Colombia’s Mercado Pago leads transfers through PSE. If these gateways are missing, carts are abandoned and trust disappears.

Currency support matters just as much. Enabling deposits and withdrawals in pesos or reales spares players conversion fees, and signals the operator treats them like a local. Casinos that add instant payouts and clear fee structures speed up service and earn a valuable edge.

Mobile Dominance: Data-Light Designs Win

Smartphones drive almost all online traffic across LATAM, so any brand that ignores them is courting failure. Yet mobile success goes beyond fitting a website on a small screen; it means building services that run smoothly on flaky networks and budget handsets.

Enter Progressive Web Apps (PWAs), a lightweight layer that gives casino players app-like speed without the hassle of Big Store downloads. Pair that with smart tricks: images that shrink on command, offline pockets so play never halts, and a no-frills layout that cuts data costs for users counting every megabyte.

Market leaders also roll out lite skins, peeling off heavy animations and endless scripts in favor of bare-bones speed and rock-solid uptime. Research shows delays of even a second can send players packing, turning lean design from a tech choice into a profit-or-loss showdown.

Localization Beyond Language: Bonuses and UI

Translation may get the words right, but it rarely captures what a player actually feels. Rewards, loyalty plans, and promos need to mirror local rhythms or they fade into the noise. A Holy Week rebate or a Festas Juninas gift card, for example, speaks straight to a Brazilian wallet and makes gaming personal.

User interfaces should always respect the tastes of the region. Across most LATAM markets, bold colors and lively animations win users more reliably than soft, stripped-back looks. Themes that borrow from local myths, beloved athletes, or street parties hit harder and draw stronger emotional ties.

Clear, honest talk about bonuses – especially wagering rules – matters just as much. LATAM players often arrive wary and quick to abandon sites that hide or twist the fine print. Simple, plain-language promises and fair play keep satisfaction high and churn low.

LATAM Regulation: Fragmented Today, Unified Tomorrow?

The legal landscape across LATAM still looks like a patchwork quilt, with every nation moving at its own rhythm. After years of debate, Brazil has at last laid down the first stones for an official iGaming market. Rules passed in 2023 set out licensing, tax rates and ad norms, marking a huge step for the region.

Colombia stays ahead, having greenlit online gambling in 2016 and handing out more than twenty operators’ licences since then. Its clear framework shows how steady oversight can tempt first-class global brands while still shielding everyday players.

Yet nations such as Venezuela and Bolivia remain at the back, relying on vague or years-old laws. So, firms chasing regional growth move quickly, launching under Curacao or MGA permits and promising to shift to local licenses once the rules firm up.

This patchwork of regulations calls for clear-eyed planning. Online casinos must link arms with lawyers and compliance pros who can steer them through local quirks, keep them out of gray markets, and support lasting operations.

LATAM’s online casino field is tricky but lucrative. Brands that respect local culture, invest in thorough localization, and build mobile-first sites stand a strong chance. As rules continue to modernize and user appetite grows, happy young audiences and friendly smartphone stacks regions shine as a fresh frontier for global iGaming.

The post The LATAM Online Casino Market: Where Innovation Meets Localization appeared first on Gaming and Gambling Industry in the Americas.

Brendan O’Kane CEO at OtherLevels

The missing link: Transforming available data into hyper-relevant activation and engagement

Published

39 seconds ago

June 18, 2025

GamingAmericas.com

the-missing-link:-transforming-available-data-into-hyper-relevant-activation-and-engagement

Brendan O’Kane, CEO at OtherLevels, reveals how transforming data into more relevant and sophisticated communications is hugely successful at activating and engaging customers.

Fewer than 100 days out from the start of the new NFL season, sportsbooks will be planning their marketing strategies to maximize the engagement opportunities that the season brings.

A month after the Philadelphia Eagles go up against the Dallas Cowboys, the NBA season also gets underway. Both landmark dates will long since have been picked out by sportsbook marketing teams as hooks to reactivate existing customers.

However, OtherLevels recent research shows that a reliance on mass seasonal campaigns not only risks missing the target in terms of engagement and activation, but can actively alienate customers. Modern, digital-first customers are smart and savvy – and they see through and ignore generic communications.

Our findings showed that seasonal campaigning, driven by high-profile sports, is over-prioritised with individual customer behaviors and preferences heavily under-utilized. The study also highlighted a common gap where raw behavioral data – which all operators have access to – is not transformed into sophisticated content and media.

Activation and Engagement

To determine how effectively one of the leading US-based sportsbooks was creating relevant communications for its customers, we conducted a two-month study of mobile engagement using the app push channel. The premise behind the research was that personalized, relevant and contextual communications lift activation and engagement in sports betting.

Our research team tracked two consistent customers who placed a total of 228 similar wagers on NFL, NBA, NHL, and EPL events. Both customers consistently bet on the same teams and props with consistent cash values.

Our expectation was that the sportsbook would leverage the repeated, predictable behaviour to tailor personalized communications.

The results, however, showed a significant lack of personalization. Despite both of our users exclusively betting on professional football, basketball, soccer and hockey, 29% of communications failed to mention any of these sports.

A total of 23% of messages promoted college football or basketball, which neither customer had ever wagered on. Soccer, which accounted for 19% of total bets placed, featured in only 1% of communications.

A mere 7% of communications contained token personalization – most of which was attribute-based (customer name or location), with 93% completely lacking behavioral personalization. Crucially, the operator failed to use betting behavior to tailor content related to preferred teams, props, markets, or odds changes.

The research showed that there is a significant disconnect between what we expected in terms of personalized communications and what was delivered. It uncovers a prevalent challenge within the industry: the disparity between the availability of customer data and how to transform this into compelling content and media, suitable for use by a (generic) CRM platform.

To create campaigns that are more effective, customer data needs to be transformed into content and activation needs to be automated. This is not trivial – a personalization engine does not create content, it outputs a JSON data recommendation. Automation is equally challenging. Take the NBA as an example: given that there are over 1,300 games, without an automated content and media creation capability built for 24/7 sports, there is a fundamental gap between personalization recommendations and an exciting, in the moment, customer experience. A marketing team relying on a generic CRM platform, lacks the automated content capabilities to create sophisticated sports content and CTAs.

Customer-centric

At OtherLevels, our Experience Platform fills that gap. It combines operator or 3^rd party personalized recommendations, live odds, historical betting behaviour, and match context to create 100% automated, hyper-personalized CTA communications, for delivery by existing marTech platforms.

The positive results of this approach are clear to see. For two of the operators we work with, this customer-centric approach to marketing communications resulted in a 16% uplift in engagement across the NBA last season, an 8% lift from NFL for outbound communications and a 30% increase in on-site interaction for sophisticated NFL content.

When sportsbooks gear up for major seasons like the NFL and NBA, a default reliance on traditional CRM platforms that cannot create compelling sport content at scale leads to suboptimal engagement and risks alienating customers.

Conversely, adopting a customer-centric approach that leverages betting behavior and an automated, cutting-edge content and media engine, creates automated, hyper-personalized communications. This approach has been shown to dramatically increase activation and engagement, highlighting a clear next step for more effective sportsbook marketing.

The post The missing link: Transforming available data into hyper-relevant activation and engagement appeared first on Gaming and Gambling Industry in the Americas.

ACDV certification

GoldenRace becomes the first and only Virtual Sports provider certified for Retail in Colombia

Published

1 hour ago

June 18, 2025

GamingAmericas.com

goldenrace-becomes-the-first-and-only-virtual-sports-provider-certified-for-retail-in-colombia

GoldenRace, leading B2B provider of Virtual Sports and betting solutions, has become the first and only Virtual Sports provider officially authorised to operate in Colombia’s Retail betting market under the new ACDV regulation.

The certification is based on ACDV (Virtual Racing and Sports Betting) standards, published by Coljuegos, Colombia’s national gambling authority, at the end of last year (2024) as part of a new regulatory framework for Virtual Sports in the Retail sector, outlined in Resolution No. 20241200028984.

With this updated certification now in force, GoldenRace proudly leads the way, allowing betting shops across Colombia to legally continue offering its award-winning Virtual Sports portfolio – including bestsellers like Virtual Football, Horse Racing, and Greyhound Racing – fully compliant with the latest national requirements.

“This process involved extensive testing at a prestigious, internationally accredited laboratory,” explained Julio César Duque, LatAm Director at GoldenRace. “For us, it’s a clear confirmation of the strength of our portfolio and how well our solutions perform in Colombia.”

With the ACDV certification now active, the company is expanding its market-leading Virtual Sports content to Retail, giving local operators more.

“After a successful GAT Colombia 2025 and with the Peru Gaming Show on the horizon, we’re thrilled to keep growing in LatAm,” added Martin Wachter, CEO & Founder of Softquo, the Holding behind GoldenRace. “Colombia holds a special place for us: it’s home to one of our offices and our reforestation initiatives. We are deeply proud that its Retail operators can now enjoy the best of GoldenRace through this new certification.”

The post GoldenRace becomes the first and only Virtual Sports provider certified for Retail in Colombia appeared first on Gaming and Gambling Industry in the Americas.