Latest News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Central America
FeedConstruct takes exclusive data and streaming rights for Nicaragua’s Liga Primera
Deal covers worldwide distribution of Liga Primera and Copa Primera content for sportsbooks and betting suppliers.
FeedConstruct has acquired exclusive worldwide streaming and data rights for Nicaragua’s top-tier football competitions, Liga Primera and Copa Primera.
The company said the agreement delivers start-to-finish coverage of every match across both competitions and expands its Central American football portfolio for sportsbook operators and providers using its data integration and streaming.
Ani Isakhanyan, Head of Rights and Content at FeedConstruct, stated, “Securing these exclusive rights is a highly valuable addition to our portfolio. Liga Primera and Copa Primera deliver the consistent football content that the global iGaming industry demands. This acquisition ensures our partners can offer comprehensive coverage of a rapidly emerging betting market.”
Allan J. Chamorro, Managing Partner at Apollo Sports Business Group, added, “Nicaragua has rapidly established itself as one of Central America’s fastest-growing football markets, attracting growing regional recognition and international commercial interest. Our partnership with FeedConstruct builds on that momentum by expanding the global distribution of Liga Primera and Copa Primera while powering sustainable commercial opportunities that strengthen clubs, elevate the competitions, and accelerate the long-term growth of the game.”
Liga Primera and Copa Primera are the main competitions in Nicaragua’s professional football calendar. FeedConstruct said the competitions are gaining regional recognition in Central America, supported by regular participation in CONCACAF tournaments.
The post FeedConstruct takes exclusive data and streaming rights for Nicaragua’s Liga Primera appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
The UAE Lottery has partnered with SmartLife Foundation to support outdoor workers during the UAE summer, backing the Cool Bus Shelter initiative in Abu Dhabi on July 20, 2026.
The programme aligns with the UAE’s Midday Break rules, which require outdoor work to stop between 12:30 PM and 3:00 PM during peak heat. As part of the initiative, air-conditioned buses were stationed near labour sites to provide workers a place to rest before returning outdoors.
Volunteers from The UAE Lottery and SmartLife Foundation provided cold towels, cold water and drinks, according to the organisations. Workers also received portable rechargeable neck fans intended to provide additional cooling after the break.
Suzan Kazzi, Associate Director – Corporate Social Responsibility at Momentum- The UAE Lottery, said: “Outdoor workers are the backbone of our cities’ urban development, and initiatives like the Cool Bus Shelter ensure they receive the care and recognition they deserve during the most challenging months of the year. This is our small way of saying thank you and reminding them that their wellbeing truly matters”.
Abhijeet Oak, Vice President at SmartLife Foundation, added: “At SmartLife Foundation, we believe that protecting the wellbeing of outdoor workforce is a shared responsibility. Through the Cool Bus Shelter initiative, we are proud to collaborate with organizations such as The UAE Lottery and other community partners to create moments of comfort, appreciation and human connection that leave a lasting impact”.
The post The UAE Lottery backs Cool Bus Shelter initiative for outdoor workers appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
Bally’s Intralot
Intralot Ireland Limited Signs Seven Year Contract Extension with Premier Lotteries Ireland
Bally’s Intralot announced that its subsidiary Intralot Ireland Limited has signed a seven year contract extension, through November 2034, with Premier Lotteries Ireland (PLI). The agreement supports PLI’s continued operation of the Irish National Lottery through the remainder of its license period and reinforces Bally’s Intralot’s role as a trusted technology and services partner.
Under the terms of the agreement, Bally’s Intralot will modernise PLI’s technology ecosystem by deploying its next-generation LotosX Omni solution and PlayerX Player Account Management platform. The solution will provide a modern, cloud-based technology foundation supporting lottery operations across retail and digital channels, while incorporating advanced retailer management, instant games management, device management and content management capabilities. The agreement also includes comprehensive support and maintenance services, along with cloud operations and cybersecurity services for the first year, designed to ensure the long-term reliability, security and performance of PLI’s technology environment.
Through this partnership, Bally’s Intralot will support PLI in delivering a future-ready operating environment designed to enhance operational efficiency, accelerate innovation and strengthen player engagement. The modernisation will provide a secure, scalable and resilient platform that enables PLI to continue evolving its offerings while improving time-to-market implementation of new initiatives, along with maintaining the highest standards of reliability and service to players and retailers across Ireland.
“We are pleased to extend our partnership with Bally’s Intralot, a relationship built on trust, commitment to excellence, and shared ambition since 2014. As we look to the future, this agreement provides a strong platform for continued innovation and growth, ensuring we can deliver a modern, secure, and world-class National Lottery that places responsible play at its heart while continuing to benefit communities across Ireland,” said Cian Murphy, CEO of PLI.
Robeson Reeves, CEO of the Bally’s Intralot Group, said: “We are proud to extend our long-standing partnership with Premier Lotteries Ireland for a further seven years. This agreement reflects the strength of our technology and the trust we have built with PLI over more than a decade of collaboration. We look forward to continuing to support the National Lottery of Ireland and to delivering innovative, responsible gaming experiences to players across the country.”
The post Intralot Ireland Limited Signs Seven Year Contract Extension with Premier Lotteries Ireland appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
-
ESPN Networks3 days agoTHE 57th ANNUAL WORLD SERIES OF POKER® CONCLUDES AN EXTRAORDINARY SUMMER OF GLOBAL ENGAGEMENT AND ELITE COMPETITION
-
Latest News7 days ago
EveryMatrix’s Fantasma Games launches three-reel slot Bonus Bullets
-
Latest News5 days ago
Booming Games launches Tasty Bonanza Max Scatter slot
-
Latest News6 days ago
SCCG Management Launches Dedicated SCCG Brazil Division with Local Partner Thomas Carvalhaes
-
Latest News7 days ago
Blokotech adds Wicked Games slots in new content deal
-
Latest News6 days ago
Esportes Gaming Brasil takes two ClienteSA Awards 2026 wins; exec named Personality of the Year
-
Canada6 days ago
ThrillTech secures AGCO supplier licence for Ontario launch
-
Canada5 days ago
Peter & Sons launches full game portfolio in Alberta
