Industry News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

6 years ago

October 22, 2020

George Miller

Reading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

Source

Industry News

RAW iGaming unveils RAW Riches: A site-wide progressive jackpot overlay built for scale

Published

19 hours ago

April 29, 2026

Wladimir P.

raw-igaming-unveils-raw-riches:-a-site-wide-progressive-jackpot-overlay-built-for-scale

RAW iGaming announces today the launch of RAW Riches, a site-wide progressive jackpot overlay designed to deliver jackpot moments without adding operational complexity.

Launching as part of the RAWVerse ecosystem, RAW Riches introduces a new approach to jackpots, prioritising seamless integration, player engagement, and operator control.

A fully embedded experience

RAW Riches introduces a multi-tier progressive jackpot layer deployable across an operator’s entire portfolio, regardless of game supplier. Unlike traditional jackpot mechanics that require separate integrations or fragmented systems, RAW Riches operates as a fully embedded experience within the operator’s brand, creating a single, unified jackpot.

Tom Wood, CEO of RAW iGaming, said: “The industry built jackpots in silos. We built one that connects everything.

“RAW Riches gives operators a site-wide jackpot running across every entity and every game supplier, configured to their exact needs and brand, all from a single solution.

“We pride ourselves on producing the industry’s most distinctive and disruptive game concepts and RAW Riches is no different.

“This is the kind of product that changes how operators think about jackpots entirely.”

A seamless player experience

Players opt in and continue playing as normal. When triggered, the jackpot experience takes over instantly. Every trigger results in a win, with no losing outcomes, before the player is returned to their original game to continue playing.

Scaleable without complexity

RAW Riches solves one of the industry’s most persistent operational challenges in scaling jackpots across multiple providers, brands, and markets. Key features include:

Single deployment across all games and brands
Full operator control over jackpot configuration and branding
Multiple delivery options, including bespoke branded game builds
Seamless deployment within any existing RAW integration or delivery partner

RAW Riches is available today across regulated markets in Europe.

The post RAW iGaming unveils RAW Riches: A site-wide progressive jackpot overlay built for scale appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.

Carsten Koerl

Sportradar Reports First Quarter 2026 Financial Results

Published

21 hours ago

April 29, 2026

Wladimir P.

sportradar-reports-first-quarter-2026-financial-results

Sportradar Group has announced the financial results for its first quarter ended March 31, 2026.

Carsten Koerl, CEO of Sportradar Group, said: “Sportradar’s first quarter growth reflects our premier position as the scaled leader in the expanding global sports data ecosystem. We continue to deepen our relationships across our expansive distribution network, providing additional content, products and services to our sportsbook, media and technology clients. Our recently acquired portfolio of IMG content has further bolstered our diverse offering and is resonating with customers worldwide while also expanding our margins as we increasingly leverage our existing infrastructure. Maximizing the opportunities our market leadership position and long-standing relationships remains our priority as we also begin to capitalize on new avenues of growth, including prediction markets and iGaming. Driving value for our partners and clients has always been our focus and continuing to do so should build additional shareholder value in the months and years ahead. Our confidence in our trajectory is demonstrated by the increased buyback activity this past quarter as well as the enhanced open market share repurchase program announced today.”

Total revenue for the first quarter was €347 million, up €35 million, or 11% year-over-year, driven by 15% growth in Betting Technology & Solutions, partially offset by a 4% decline in Sports Content, Technology & Services.

Betting Technology & Solutions revenues of €288 million were up 15% year-over-year primarily driven by a 20% increase in Betting & Gaming Content due to contributions related to the acquisition of IMG ARENA, uptake of the Company’s content and products, as well as U.S. market growth, partially offset by the significant impact of foreign currency movements. Managed Betting Services revenues declined 2%, as higher turnover in the Managed Trading Services business was offset by unfavourable sporting outcomes during the quarter.

Sports Content, Technology & Services revenues of €59 million declined 4% year-over-year primarily driven by a 9% decline in Marketing & Media Services, due primarily to a reduction in marketing campaigns from certain existing customers during the quarter, partially offset by increased revenue from Integrity Services.

The Company generated strong revenue growth globally with Rest of World up 14% and the US up 4%. Foreign currency movements, particularly due to the U.S. dollar relative to the Euro, continue to negatively impact earnings. As a percentage of total Company revenues, US revenue represented 26% of total Company revenue in the first quarter as compared to 28% in the prior year quarter.

Loss for the period was €6 million, down €31 million, compared to a profit of €24 million in the same quarter a year ago, as the Company’s strong operating results were more than offset primarily by a foreign currency loss of €9 million versus a gain of €28 million in the same period a year ago, due principally to unrealised currency fluctuations mainly associated with U.S. dollar-denominated sports rights. The first quarter of 2026 also included higher depreciation and amortization and finance costs primarily related to the acquisition of IMG ARENA, partially offset by lower income taxes.

Adjusted EBITDA

First quarter Adjusted EBITDA was €66 million, up €7 million, or 12% compared to €59 million in the same quarter in 2025. The increase was largely driven by the 11% revenue growth, primarily offset by the inclusion of costs related to IMG ARENA, most notably sport rights.

Business Highlights

Announced key addition to Sportradar’s leadership team, naming Sameer Deen as Chief Operating Officer, commencing May 18, 2026.

Launched Playradar, a dedicated iGaming brand delivering hybrid sports-casino content to global operators across slots, table games, virtual sports, arcade and crash games, operating exclusively in regulated markets.

Expanded the Company’s multi-year partnership with Hard Rock Bet, adding official PGA TOUR and UFC data and enhanced in-play betting capabilities including 3D shot tracking and micro markets.

Extended and expanded the Company’s integrity services agreement with FIFA for an additional five years through 2031, providing AI-driven bet-monitoring, intelligence and investigation support, and risk assessment services across FIFA’s 211 member associations and competitions worldwide.

Announced a multi-year partnership with the Liga Nacional de Basquete for worldwide rights for official data as well as audiovisual betting, completing Sportradar’s presence across Brazil’s three most popular sports.

The post Sportradar Reports First Quarter 2026 Financial Results appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.

game-mechanics

Microgaming rolls out Link & Merge mechanic with three-slot launch on 29 April

Published

23 hours ago

April 29, 2026

Wladimir P.

microgaming-rolls-out-link-&-merge-mechanic-with-three-slot-launch-on-29-april

Microgaming is launching a new slot mechanic, Link & Merge, on 29 April via the simultaneous release of three titles: Almighty Zeus Wilds Link&Merge, Lucky Twins Wilds Link&Merge and 123 Soccer Link&Merge.

The Link&Merge feature is positioned as a variation on Hold & Spin-style gameplay. When five or more adjacent Coin symbols land, they link and merge into a single higher-value symbol. The merge then triggers one of three bonus outcomes: Jackpot, Multiply or Spread, with the potential for additional Coin symbols to land and create further merges.

Microgaming is pairing the mechanic with three themes at launch: Almighty Zeus Wilds Link&Merge, Lucky Twins Wilds Link&Merge and 123 Soccer Link&Merge. The supplier said each title uses the Link&Merge bonus within a shared core framework that includes cluster wins, Wild Meter progression, Free Spins and Multiplier Trail functionality.

A Microgaming spokesperson said: “Link&Merge gives us a mechanic with real forward momentum. Each merge has the potential to change the shape of the feature, open up new opportunities and keep the round moving in a way that feels both familiar and fresh. By launching three games around it simultaneously, we are able to give the mechanic a much bigger stage from day one and show the range it can bring to the Microgaming portfolio.”

The post Microgaming rolls out Link & Merge mechanic with three-slot launch on 29 April appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.