Latest News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Boomerang Partners
Overtime begins: Boomerang Partners launches the final stage of the Golden Boomerang Awards 2026
The Golden Boomerang Awards 2026 by Boomerang Partners is moving into its decisive phase. The third and final stage of the tournament – titled “Overtime” – will run from 20 July to 31 August. It marks the last opportunity for participants to reshape the leaderboard and compete for the season’s main prize – an exclusive private dinner with a football legend in September 2026.
Overtime mechanics: points allocation
To intensify competition during the final stretch, Boomerang Partners is introducing an updated scoring system. From now on, affiliate teams will earn 3 points for every FTD generated on any partner brand from the Agency’s clients’ portfolio. In the previous stage, participants received 3 points for each sports FTD and 1 point for each online casino FTD. Now, the value of all FTDs is identical.
Overtime mechanics: performance boosts
Within the Overtime stage of the Golden Boomerang Awards 2026, a set of performance boosts remains active. These mechanics give participating teams the opportunity not only to catch up but also to overtake the leaders.
- Welcome Boost – x2 points for the first 14 days after entering the stage
- Lucky Five – +5 points for achieving 10 Casino FTDs per week
- Last Minutes Winner – x3 points during the final 7 days of Overtime
Martin Černý, CEO at Boomerang Partners said: “Overtime brings the Golden Boomerang Awards 2026 to its most competitive stage. At this point in the tournament, every result can influence the leaderboard, and teams still have the opportunity to improve their positions. We expect the final weeks to bring strong competition and determine the final standings.”
A final stretch where every day counts
With fewer than 40 days left in the GBA 2026, the competition enters its most volatile phase. The leaderboard remains open, and even small performance shifts can significantly alter final standings. Participants are now entering a stage where strategy, timing, and consistent activity define the outcome – and where the final push may determine the season’s ultimate winner.
Overtime has begun. TIME TO WIN THE TITLE.
About Boomerang
Boomerang Partners is a rapidly growing global marketing agency offering a wide range of services. In 2024, it launched the inaugural Golden Boomerang Awards – a global tournament for affiliate teams. More than 400 affiliate teams participated in the second season of the tournament in 2025. Martin Černý – Boomerang Partners’ CEO since June 2025.
The Agency’s clients’ portfolio contains brands offering affiliate and entertainment services across multiple markets in compliance with local regulations. These products provide incentive programs and 24/7 multilingual support.
The post Overtime begins: Boomerang Partners launches the final stage of the Golden Boomerang Awards 2026 appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
The trophy has been lifted. Now comes the most interesting part for operators: counting the revenue, assessing what worked, learning from what didn’t, and deciding what to change before the next betting event.
On Thursday, August 20, at 4:00 p.m. CEST, GR8_TECH will host “The Locker Room: World Cup Numbers”, a closed-door benchmarking session created to help operators make sense of their tournament results and see how their performance stacked up against the room and the wider market.
Led by Dinos Doxiadis, Head of Sportsbook Business at GR8_TECH, the session will combine anonymized benchmarks with in-depth post-World Cup platform data on margin, player behavior, retention, and peak-load performance. It isn’t a tournament recap, but a working session built around deeper analysis than GR8_TECH releases publicly.
A First Look at the World Cup Numbers
Initial aggregated data from the GR8_TECH platform shows an average tournament margin of over 12%, alongside a significant increase in staking during the knockout stages.
Average stakes during the play-offs were 53% higher than during the group stage, while the average stake on the final was 89% above the tournament average.
Player interest was highly concentrated. Matches featuring Spain, Argentina, England, or France generated 42% of the total World Cup turnover. Argentina was the tournament’s most-bet-on team, accounting for 12.5% of all bets, although Spain finished only 0.09 percentage points behind Argentina by turnover.
The final also created one of the tournament’s most demanding operational moments. Within one minute of the final whistle, GR8_TECH’s platform settled more than half a million bets, demonstrating the level of processing performance required when a global audience reaches the same outcome simultaneously.
Inside The Locker Room, participants will examine what happened across:
- Live betting and bet builders
- Margin and staking dynamics
- Peak-load and settlement moments
- Acquisition compared with player reactivation
- Retention beyond the final whistle
- Unexpected geographic performance
- Operational, product, and campaign failures
- Priorities for the next major event
“The World Cup generates a huge amount of data, but the value comes from understanding what sits behind it,” said Dinos Doxiadis, Head of Sportsbook Business at GR8_TECH. “This session is about identifying the patterns operators might miss in their own reporting, challenging assumptions, and turning one month of World Cup activity into better decisions for future events.”
See How Your World Cup Stacked Up
Leave the session with anonymized benchmarks, exclusive GR8_TECH platform insights, and a clear view of where your World Cup performance led—or lagged—the market.
Turn the lessons into your next strategy. Join The Locker Room: World Cup Numbers on Thursday, August 20, at 4:00 p.m. CEST.
Register here to secure your place.
GR8_TECH. Platform for Champions
GR8_TECH is an award-winning provider, delivering high-performance sportsbook and iGaming solutions that empower operators to lead and win in competitive markets. GR8_TECH’s comprehensive portfolio includes the GREAT_TURNKEY and GREAT_CRYPTO TURNKEY solutions, GREAT_SPORTSBOOK, and GREAT_CASINO AGGREGATION.
With a geo-specific approach to solutions, a focus on practical innovations, and an operator-first mindset, GR8_TECH helps its clients achieve measurable results in their target markets quickly and efficiently. Trusted by top operators worldwide, GR8_TECH has over 100 successful cases and earned multiple recognitions, including the title of Platform Provider of the Year by SBC Awards 2025.
The post The World Cup Is Over. GR8_TECH Opens “The Locker Room” to Count What It Was Worth appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
ELA Games has released a new slot, Age of Cleopatra, adding another ancient-Egypt theme title to its portfolio. The studio positions the game as a medium-volatility release and says it is available to demo now.
Age of Cleopatra runs on a 5×3 reel set-up with 25 paylines. ELA Games lists RTP at 93.75% / 95.73%, with Buy Bonus RTP at 93.8% / 95.9%. The maximum win is x5000, according to the company.
In the base game, a Collect Symbol gathers coin prizes visible on the screen, while “colored coins” charge pyramids that can unlock additional value, ELA Games said. The slot’s Hold & Win Bonus Game awards three respins by default (or four in an “Extra Respin” version), with modifiers tied to collected coins.
Features named by the studio include Multipliers, Extra Respins, and an Expand Grid mechanic that increases the layout from 3×5 to 5×5. ELA Games also states that multiple features can trigger at the same time.
“You can’t do justice to a legendary theme with just background art. Building a world around Cleopatra meant it had to feel truly authentic, a standard we apply to all our releases. At ELA Games, we consistently look beyond the visuals to craft an original universe, keeping storytelling through the mechanics at the center of our titles.” Marharyta Yerina, Managing Director at ELA Games.
The post ELA Games launches Age of Cleopatra slot with Hold & Win bonus appeared first on EE Gaming | Global iGaming & Tech Intelligence Hub.
-
ESPN Networks6 days agoTHE 57th ANNUAL WORLD SERIES OF POKER® CONCLUDES AN EXTRAORDINARY SUMMER OF GLOBAL ENGAGEMENT AND ELITE COMPETITION
-
Canada7 days ago
PENN Entertainment Launches theScore Bet Sportsbook & Casino and theScore Casino and Hollywood Casino Standalone Apps in Alberta
-
Latest News7 days ago
Weekend Reels | Week 29: Slot Drops & Trends
-
Compliance Updates7 days ago
Finland notifies EU of gambling tech rules for data vault and OCSS signing
-
Latest News7 days ago
Jumio Enters into Partnership with BOYLE Sports
-
Latest News6 days ago
DELULU Gaming Hosted an Exclusive Soft Launch Dinner for 250+ iGaming Leaders in London
-
Alberta4 days ago
Greentube goes live in Alberta as province opens regulated iGaming
-
Artificial Intelligence6 days ago
BetConstruct AI hosts Harmony Predictstreet event in Yerevan
