Industry News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

5 years ago

October 22, 2020

George Miller

Reading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

Source

AI

Despite AI’s Rise, Fraud Teams Keep Growing — SEON 2026 Report

Published

5 days ago

March 4, 2026

Wladimir P.

despite-ai’s-rise,-fraud-teams-keep-growing-—-seon-2026-report

SEON, the command centre for immediate Fraud Prevention and AML Compliance, has unveiled AI Reality Check: 2026 Fraud & AML Leaders Report, the second iteration of its sector research, derived from a worldwide survey of 1,010 leaders in fraud, risk, and compliance spanning payments, fintech, financial services, retail, eCommerce, and gaming.

The figures reveal an unforeseen narrative: AI is ubiquitous, yet operations are not becoming easier to manage. Currently, 98% of organizations utilize AI in fraud and AML processes, with 95% expressing confidence in its effectiveness; meanwhile, headcount plans rose from 88% to 94% year-over-year, and 83% anticipate budget increases in 2026.

Complexity Is Surpassing Automation

AI has not lessened the workload — it has revealed the extent of work that has always existed. Fraud losses are increasingly approaching revenue growth, threats are advancing more rapidly, and disjointed systems restrict the true potential of AI at scale. Key year-over-year shift:

Leadership’s confidence in their teams’ performance is lagging. The number of leaders who disagreed with the statement, “fraud losses are growing faster than revenue,” dropped by almost 40% from the previous year

Inside the Numbers:

AI is baseline, not experimental

98% already integrate AI into daily workflows (only 2% still planning)
95% are confident AI can detect and prevent fraud (52% very confident)
Top use case: AI/ML for transaction monitoring (30%)

Fraud and AML investment keeps climbing

83% expect fraud/AML budgets to increase in 2026
94% plan to add at least one full-time hire (up from 88% in 2025)
85% plan to add a vendor, 49% plan to replace one

Fragmentation is the bottleneck

95% claim “some integration” between fraud and AML systems
Only 47% run fully integrated workflows; the rest rely on partial connections
80% say getting a unified view of data is challenging

For many, time-to-value remains slow

Only 10% go live in under two weeks
38% take 1–3 months, 24% take 4+ months
When implementations run long, top impacts include increased costs (52%) and prolonged fraud exposure (47%)

Teams are growing, not shrinking

94% plan to increase headcount despite automation gains
85% see AI agents as support/augmentation, not replacement (only 12% see eventual replacement)

Top fraud threats reported:

Account takeovers: 26%
Promo/discount abuse: 18%
Return fraud: 18%

“Fraud and financial crime were supposed to become more manageable as AI matured,” said Tamas Kadar, CEO and co-founder, SEON. “Instead, 2026 is the year leaders are confronting a more complicated reality. AI adoption is real, confidence is high, but the scale and pace of fraud — compounded by fragmented systems — continue to drive increased investment rather than reduced overhead. The bottleneck is no longer whether AI works. It’s everything around it: disconnected data, siloed teams, slow implementations. The organisations that pull ahead will be the ones that unify fraud and AML intelligence, shorten the distance between threats and controls, and treat integration as strategy, not plumbing.”

Fast-Growing Companies Invest in Integration Early

Organisations growing 51%+ are nearly twice as likely as slower peers to report that achieving unified visibility is “not very challenging.” They treat integration as infrastructure, not an IT project.

What’s Next: From “Does AI Work?” to “Can We Trust It?”

With adoption near-universal, the conversation is shifting to governance, explainability and accountability:

78% say decentralised digital identity will become central to fraud/AML
33% cite data privacy regulations (GDPR, CCPA) as the biggest external force shaping AML
25% point to criminals’ advancing use of AI and obfuscation techniques

The post Despite AI’s Rise, Fraud Teams Keep Growing — SEON 2026 Report appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.

Ashley McCulloch Vice President North America at Evoplay

Evoplay Names Ashley McCulloch Vice President North America

Published

5 days ago

March 4, 2026

Wladimir P.

evoplay-names-ashley-mcculloch-vice-president-north-america

Evoplay, the acclaimed game development studio, has named Ashley McCulloch as Vice President North America, strengthening its strategic emphasis on growth throughout the US and Canada.

McCulloch has over 15 years of experience that includes land-based, VLT, and online gaming. She has occupied high-level commercial positions at IGT and Light & Wonder and most recently worked as Director of Account Management North America at Inspired Gaming Group, where she led strategic account development and assisted with new market entry projects.

In addition to her commercial success, McCulloch serves as a board member for Women in Sports and Events, is part of Global Gaming Women, and was recognized in the 2024 Emerging Leaders in Gaming 40 Under 40, highlighting her influence in the industry.

At Evoplay, McCulloch will lead partnerships, regulatory licensing, product launches, and broader business development efforts as the provider speeds up its growth in the North American market.

Evoplay has secured a significant presence in the area, launching in Ontario via collaborations with prominent operators in the province, such as BetMGM and Caesars Entertainment.

In November 2025, Evoplay made a notable initial move into the United States by joining the lottery sector in Washington DC, establishing a connection to the US online gaming landscape.

With McCulloch’s hiring, the company aims to leverage this momentum and continue its expansion throughout regulated US states.

Ivan Kravchuk, CEO at Evoplay, said: “North America represents one of the most exciting growth opportunities for Evoplay, and Ashley McCulloch’s appointment is a major step forward in realising our ambitions in the region.

“Her extensive experience across land-based and online gaming, combined with her track record in commercial strategy, makes her the ideal person to lead our efforts as we scale.”

Ashley McCulloch, Vice President North America at Evoplay, added: “I’m very excited to be joining the Evoplay team at such a pivotal moment in its growth journey.

“The studio has built a strong reputation for high-quality content, and I look forward to developing partnerships and driving sustainable growth across North America.”

The post Evoplay Names Ashley McCulloch Vice President North America appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.

Africa

VeliGames Secures SiGMA Africa’s Industry Rising Star Award

Published

5 days ago

March 4, 2026

Wladimir P.

veligames-secures-sigma-africa’s-industry-rising-star-award

VeliGames, a game aggregation platform from VeliTech, has received the Industry Rising Star award at the SiGMA Africa 2026 Awards, highlighting the platform’s swift innovation and significant influence on African iGaming.

The Industry Rising Star award highlights a developing company that displays remarkable potential, creativity, and influence, rapidly positioning itself as a forthcoming leader in the iGaming sector. It emphasizes VeliGames’ dedication to providing not just a content pipeline, but also genuine innovation and a comprehensive growth engine for operators in developing markets.

“Winning the SiGMA Africa Award for Industry Rising Star 2026 is a proud moment for our team. From day one, we built VeliGames with African operators in mind, combining local-fit content, practical tooling, and pricing that makes sense on the ground. We back it all up with hands-on operational know-how from working in the region. That’s what being a true content partner looks like.” Irakli Kakhidze, CEO at VeliGames.

Tailored for Africa’s infrastructure challenges, device characteristics, and user habits, VeliGames provides a performance-oriented casino content layer aimed at thriving in areas where conventional, high-bandwidth aggregation methods struggle. Rather than solely competing based on catalogue size, VeliGames prioritizes the key factors that genuinely contribute to casino success in Africa: speed, accessibility, conversion, and session stability.

The platform delivers content in a highly efficient, mobile-centric setting designed to function dependably amid variable connectivity, restricted device storage, and brief gaming sessions, assisting operators in ensuring seamless gameplay and enhanced player experiences on a larger scale.

Alongside curated third-party titles, the platform includes exclusive in-house content:

VeliPlay: bold, crash-and-fast titles built for immersion, retention, and high replay value
Heaven of 7: high-impact slot content designed for strong engagement, session after session

Visit VeliTech at Stand 096 from March 3-5 to learn why VeliGames was honored as the Industry Rising Star. Discover live game demonstrations, witness performance features in action, and learn how operators can create unique iGaming brands with a platform designed for regional requirements.

The post VeliGames Secures SiGMA Africa’s Industry Rising Star Award appeared first on Eastern European Gaming | Global iGaming & Tech Intelligence Hub.