Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Expanse Studios, a subsidiary of Meridian Holdings Inc., announced the deployment of proprietary jackpot and tournament mechanics across its portfolio, providing B2B operator partners with engagement tools designed to enhance player entertainment value.
The system introduces two jackpot formats—Happy Hour Jackpot and Mystery Jackpot—alongside four tournament competition variants. Operators can control prize structures, scheduling parameters and promotional configurations through platform interfaces.
Happy Hour Jackpot provides scheduled jackpot events aligned with operator promotional strategies, enabling coordinated marketing campaigns and player communication around jackpot opportunities.
Mystery Jackpot delivers multi-tier progressive prize mechanics integrated into gameplay, with operator-configurable prize values and event parameters that support diverse promotional objectives.
Tournament mechanics include four competition formats:
• Bonus Buy tournaments create competitive environments for players who choose to engage with bonus purchase features, with scoring designed to reward strategic gameplay decisions.
• Spin Count tournaments track player activity across gameplay sessions, offering multiple entry opportunities and achievement-based progression that accommodates different play styles.
• Combo tournaments combine multiple competition elements, enabling operators to design promotional events that appeal to diverse player preferences and gaming behaviours.
• Time-based tournaments operate within defined promotional windows, allowing players to participate according to their own schedules while competing for tournament prizes.
“Content providers increasingly compete on operational capabilities, not just game quality. This positions our portfolio as solutions-oriented infrastructure that helps operators execute diverse promotional strategies while maintaining control over player engagement parameters,” said Damjan Stamenkovic, CEO of Expanse Studios.
Tournament formats integrate with game interfaces through standardised promotional systems designed to enhance entertainment value while providing operators with promotional flexibility.
For Expanse Studios, the deployment strengthens competitive positioning in B2B partnerships where operators increasingly evaluate content providers based on promotional feature capabilities in addition to game performance metrics.
The post Expanse Studios Launches Proprietary Jackpot and Tournament System appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
Nils Ristau and Daniel Schmitz debut a work enablement platform aimed at day-to-day execution across product, retention and AI adoption.
Sparky Space, a new AI-powered work enablement platform founded by former German Air Force officer Nils Ristau and tech leader Daniel Schmitz, has launched and is now available globally for iGaming operators and suppliers.
The founders are positioning the product around execution support inside daily workflows as teams face tighter regulatory demands, faster product cycles and higher player expectations. The company cited industry research suggesting only 10-20% of learning is consistently applied in day-to-day work, creating a gap between training and on-the-job outcomes.
“In military operations, performance depends on clarity, structure, and disciplined execution in changing environments,” said Ristau. “The iGaming industry operates under similar pressure.
“Competitive advantage does not come from knowledge alone – it comes from how effectively teams apply it every day.”
Sparky Space said its platform supports areas including product development, player retention and AI adoption, with use cases spanning customer-centric experimentation, agile product and game development, decision-making and prioritisation, practical generative AI prompting, and cross-functional collaboration. The company said the tools are intended to help teams launch features, respond to regulatory change, and optimise marketing and support processes.
While initially focused on iGaming, Sparky Space said it has been built for broader use in other fast-moving, technology-driven industries.
Relevant data as follows:
- Sparky Space: https://www.sparkyspace.com Official company site for product and launch details.
- UK Gambling Commission: https://www.gamblingcommission.gov.uk Regulatory context referenced in the article’s discussion of increasing compliance pressure.
- Malta Gaming Authority: https://www.mga.org.mt Key European regulator relevant to operators and suppliers navigating shifting regulation.
The post Former German Air Force officer launches Sparky Space AI platform for iGaming teams appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
The slots supplier says its portfolio now exceeds 150 games and highlights recent LatAm expansion from its Buenos Aires base.
Belatra is marking its 33rd birthday with an anniversary campaign running throughout April, the iGaming slots developer said.
The company said it was founded in 1993 and has since transitioned from building gaming machines for land-based casinos to producing digital content. Belatra added that its portfolio has grown to more than 150 games.
Belatra also pointed to its strategic Latin American headquarters in Buenos Aires as a key base for regional partnerships and growth.
Misha Voinich, Head of Business Development at Belatra, said: “We’re only just getting started, but birthdays provide the perfect chance to reflect on our successes and the path that’s brought us here. From launching our innovative ‘multi-universe’ content strategy to our rapid expansion in Latin America, the successful launch of our first Crash game, and multiple high-profile industry award wins — we are always developing, creating, and evolving. 33 years of innovation, dedication, and gaming excellence — and the best is yet to come.”
Belatra did not provide additional detail on upcoming releases or the timing of any new product announcements beyond saying updates will land during April.
The post Belatra marks 33 years with April anniversary campaign appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.
-
betting innovation7 days agoDATA.BET Expands at SiGMA South America 2026
-
Brazil5 days ago
Fernando Carvalho outlines new era for prediction markets in Brazil with VoxFi white label technology
-
appointments5 days ago
Golden Whale names Jaime Ocampo Managing Director, Asia
-
Brasil5 days ago
Fernando Carvalho define una nueva era para los mercados de predicción en Brasil con VoxFi
-
Africa5 days ago
BC.GAME launches Nigeria site after securing Lagos betting and casino licence
-
Affiliate Industry4 days ago
Alberta’s Next Step into a Regulated Commercial Gambling Market: What it Means for Operators and Affiliates
-
game release5 days ago
Spinomenal launches 3 Fortune Mummies Hold & Hit slot
-
Africa4 days ago
Playson goes live with Betika in Kenya and Uganda
