Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Reading Time: 2 minutes
PayDo, a leading global payment ecosystem founded by Serhii Zakharov – who at just 25 became one of the youngest CEOs approved by the FCA to run an Electronic Money Institution in the UK, announced a series of strategic infrastructure launches designed to dismantle the costly complexity of modern payment stacks.
The releases—Direct SEPA & SEPA Instant access, USD SWIFT Accounts, Dedicated C2B Open Banking Collections Accounts and Direct VISA and MasterCard Acquiring—are not standalone products, but integrated components of PayDo’s unified platform.
For the first time, online businesses can access this comprehensive suite under a single contract, one technical integration and with a dedicated account manager, eliminating the operational burden of managing multiple providers.
The launches directly address the primary pain points of payment fragmentation: high costs from intermediaries, slow settlement times, compliance overhead and loss of control. By securing direct memberships and building proprietary technology, PayDo now offers businesses enterprise-grade infrastructure with the agility of a FinTech.
The new services include:
• Direct SEPA & SEPA Instant: As a direct SEPA member, PayDo provides native European processing with no intermediary routing. This ensures faster, lower-cost euro transactions with immediate settlement capabilities via SEPA Instant.
• USD SWIFT Accounts: Online businesses can now receive dedicated USD account details via the SWIFT network, significantly reducing delays and fees associated with cross-border USD transactions, a critical need for a variety of cross-border operating online businesses.
• Dedicated C2B Open Banking Collections Accounts: A pioneering innovation, this service revolutionises how businesses receive payments. It enables instant, direct bank-to-business transfers from customers, offering an alternative to card networks with correct funds tracking and allocation, lower costs and real-time settlement. Functionality supports processing of +100,000 daily transactions.
• Launch of Direct Acquiring: PayDo is now a principal member acquirer for both Visa and Mastercard. This direct relationship removes a layer of intermediaries, reducing processing costs, improving authorisation rates and giving merchants greater control and transparency over their card payment flows.
These services are delivered within PayDo’s unified ecosystem, which also includes its signatory innovation – non-redirect E-Wallet checkout. This earlier innovation provided merchants with full friendly-fraud protection without any rolling reserve requirements. The new ecosystem approach allows companies in sectors like e-commerce, IT services, marketplaces, gaming and other Fintechs to streamline their entire financial operations, turning payment management from a resource drain into a competitive advantage.
Serhii Zakharov, CEO and Founder of PayDo, said: “For years, businesses have been forced to stitch together a patchwork of payment providers, each adding cost, complexity, and delay. We believe the future is not in more fragmentation, but in intelligent unification. These launches are not just new features; they are the foundational pillars of a coherent ecosystem. We are giving our clients direct control over the core rails of finance—from SEPA and SWIFT to card acquiring and Open Banking—all through one partnership. This is how we eliminate the hidden tax of fragmentation and empower businesses to scale globally with clarity and efficiency.”
PayDo’s ecosystem now processes over €5B annually for over 1000 businesses, leveraging its full regulatory compliance in the UK, Canada and the EU. The company’s direct infrastructure model is proving that the next wave of Fintech growth will be driven by consolidation and seamless integration, not further division.
The post PayDo Launches Unified Payment Infrastructure Suite for Digital Businesses appeared first on European Gaming Industry News.
Reading Time: 2 minutes
While prediction markets have recently attracted increased public attention across politics, finance and culture, Meridianbet, part of the Golden Matrix Group has supported user-generated real-world prediction markets for more than a decade through its proprietary product branded as Free Bet.
For the second half of 2025, customer participation on the Free Bet platform has recorded an 11.5% increase in ticket volumes, reflecting renewed engagement across prediction markets tied to major elections, entertainment outcomes, weather forecasting and novelty-event propositions. Free Bet continues to represent a relatively small and non-material portion of Meridianbet’s overall wagering activity.
Free Bet allows customers to propose wagers on measurable real-world outcomes across sports, politics, entertainment awards, weather forecasting, financial milestones and social statistics. Once a proposed market passes regulatory, settlement and risk review, Meridianbet acts as the professional market maker, prices the odds and takes the lay side of each wager within the Company’s licensed sportsbook framework. This single-market-maker structure enables the delivery of prediction-market-style wagering to mass-market users while ensuring regulatory compliance, operational stability and standardised settlement.
In practical terms, customers initiate Free Bet markets by submitting their own proposed prediction events through Meridianbet’s platforms or retail network. Each submission is reviewed to ensure that the proposed event is lawful, ethically appropriate, clearly measurable and capable of unambiguous settlement under applicable regulatory standards. Only after passing these checks is the event accepted and priced by Meridianbet’s trading operators, who establish odds and offer the market to the customer for wagering.
Top Prediction Markets on Meridianbet
Over the past five years, Meridianbet customers have created and wagered on thousands of custom prediction markets reflecting major real-world outcomes across political cycles, cultural awards, financial milestones, weather forecasting and social trends.
Based on internal ticket volume and platform engagement data, the following five prediction markets have ranked among the most actively played on Meridianbet during this period:
U.S. Presidential Election
Binary outcome markets and related propositions tied to the U.S. presidential election results.
Global Entertainment Awards
Custom markets associated with major award outcomes including Oscars Best Picture and BBC Sports Personality of the Year.
Weather Prediction Markets
Seasonal and location-specific forecasts, including snowfall occurrence and temperature benchmark outcomes during late winter and early spring periods.
Social Outcome Markets
Demographic and statistical propositions connected to public milestones, including birth-gender distributions during peak holiday periods and other large-scale social outcome measurements.
Regulatory & Availability Notice
The Free Bet product and related prediction market offerings are provided strictly in accordance with applicable national and local regulatory requirements and are available only in jurisdictions where such wagering formats are duly authorised by law.
Availability, market scope and wagering features may vary by location and regulatory regime. Certain jurisdictions may restrict or prohibit participation in custom prediction-based wagering products.
The post Meridianbet Reports Renewed Engagement in Custom Prediction Markets in H2 2025 appeared first on European Gaming Industry News.
AI-Driven Optimisation
HilltopAds Introduces Dedicated iGaming Feature Suite and Managed Performance Service
Reading Time: < 1 minute
HilltopAds announced the rollout of a specialised feature set built exclusively for iGaming advertisers, reinforcing the company’s focus on performance-driven media buying across global markets.
At the center of the release are newly launched, ready-to-use white- and blacklists, curated from premium traffic sources that have consistently shown strong results for iGaming campaigns. These lists are derived from performance data across thousands of active advertisers and are designed to reduce testing time while increasing the predictability of campaign outcomes.
HilltopAds is also introducing a full-managed service, giving advertisers access to dedicated iGaming specialists who will set up, launch and continuously optimise campaigns based on individual KPI requirements. This service aims to support teams looking for deeper expertise, streamlined workflows or hands-off performance management.
To mark the launch, HilltopAds is providing a $2000 bonus for all direct iGaming advertisers making their first deposit of $5000 or more using the promo code IGAVCIP.
These updates complement HilltopAds’ existing capabilities for the iGaming sector, including:
• Massive Global Reach: Over 273B monthly impressions available across 250+ countries.
• Premium Direct Traffic: Access to 39,000+ vetted websites suitable for iGaming user acquisition.
• AI-Driven Optimisation: Automated tools focused on maximising bets, deposits and high-value player actions.
• Flexible Bidding Models: CPM, CPC and CPA Goal options tailored for scale and performance control.
• Specialised Network Infrastructure: Built to support consistent delivery, stable volumes and transparent reporting for regulated verticals.
With these additions, HilltopAds aims to provide iGaming advertisers with a more data-grounded, efficient and scalable environment for user acquisition.
The post HilltopAds Introduces Dedicated iGaming Feature Suite and Managed Performance Service appeared first on European Gaming Industry News.
-
Andrew Jackson6 days agoScientific Games Adds to Information and Security Management Certifications, Continues Setting Global Industry Gold Standard
-
Eastern Europe6 days ago
HIGHLIGHT GAMES LIVE IN ROMANIA WITH FORTUNA ENTERTAINMENT GROUP
-
Best Solutions for iGaming Industry in Romania 20256 days ago
Soft2Bet Nominated for Best Solutions for iGaming Industry in Romania 2025
-
Australia6 days ago
BetMakers Signs Multi-Year Agreement to Launch CrownBet
-
Latest News6 days agoAtlaslive Shortlisted in Three Categories at the European iGaming Awards 2026
-
Latest News3 days ago
Boomerang Partners has been included in 3 prestigious industry Awards, which will be presented in January 2026
-
Balkans5 days ago
Bragg Gaming Wins Online Platform of the Year at BEGE Awards 2025
-
Latest News6 days ago
How RocketWisdom Turned From An Internal Activity Into a Marketing Case
