Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
Powered by WPeMatico
Balkans
EGT Digital Wins “Online Platform of the Year” for the Second Consecutive Year at the Golden Spade’s Awards 2025
Reading Time: 2 minutes
EGT Digital celebrated a remarkable achievement at this year’s Golden Spade’s Awards, securing the prestigious title “Online Platform of the Year” for its modular platform X-Nave for the second year in a row. The award was accepted by Georgi Mihaylov, Deputy CEO of EGT Digital, marking another milestone in the company’s continued progress and commitment to technological excellence.
In 2025, X-Nave distinguished itself through the integration of EGT Digital’s proprietary in-house AI core, developed entirely by the company’s data science team. This innovation transformed X-Nave into a holistic, intelligent ecosystem with capabilities such as real-time player protection, predictive churn prevention, intelligent campaigns, personalized game recommendations, automated bonus optimization, and enhanced QA through simulated behavior. Combined with its modular structure – comprising the CRM Engine, Gaming Aggregator, Sport Product, and Payment Gateway – X-Nave continues to serve as one of the most advanced and reliable platforms in the industry.
Accepting the award, Georgi Mihaylov expressed his gratitude: “These awards are an exceptional recognition of our work. On behalf of the EGT Digital team, a huge thank you, and I can’t wait for us to come back again next year.”
Special Recognition for Industry Leadership
The Golden Spade’s Awards also honored Mr. Vladimir Dokov, CEO of both EGT Digital and EGT, with the distinguished title “Outstanding Contribution to the Development of the Gaming Industry.” This accolade recognizes his long-term leadership, strategic vision, and significant impact on the growth and evolution of both the Bulgarian and global gaming sectors.
Mr. Dokov accepted the award with a message dedicated to his team:
“What we have achieved is not thanks to me, but thanks to our team of 4,300 people and this award belongs to them.”
A Milestone Year for the EGT Group
These recognitions highlight an exceptional year for both EGT Digital and EGT, reflecting their shared commitment to innovation, responsibility, and delivering impactful solutions for partners and players worldwide.
The post EGT Digital Wins “Online Platform of the Year” for the Second Consecutive Year at the Golden Spade’s Awards 2025 appeared first on European Gaming Industry News.
Carmen Alexander
Entain’s Pitching In Initiative Crowned Grassroots Sports Initiative of the Year
Reading Time: 2 minutes
Entain’s Pitching In initiative has beaten off fierce competition to be named Grassroots Initiative of the Year at the Global Football Industry Awards. Launched by Entain in 2020, the trailblazing initiative has made a huge impact at the non-league level of England’s national game.
Pitching In is the title sponsor of the Isthmian, Northern Premier and Southern Leagues – collectively known as the Trident Leagues – that comprise 264 clubs at Steps three and four of the non-league pyramid.
Pitching In, however, has always been about more than a flagship sponsorship. At the heart of the initiative is the ambition to enhance engagement between football clubs and their local communities. This led to Entain being the founding partner of the Trident Community Fund (TCF).
The TCF was launched to help clubs establish and expand community initiatives, maximising the remarkable impact that grassroots football clubs have on their local area. Every club in the Trident Leagues is encouraged to apply for a grant of up to £5000 annually to support community initiatives. The TCF has now supported more than 150 such projects, helping to expand youth, women’s and walking football, as well as supporting initiatives focusing on local upskilling, tackling anti-social behaviour and supporting local veterans and food banks.
In 2022, Pitching In launched the Volunteer Hub to provide a one-stop online portal for clubs to post volunteering vacancies and for local people to sign up and get involved.
Pitching In’s contribution to the grassroots game has now been recognised at the Global Football Industry Awards, a landmark global ceremony which brings together industry giants and trailblazers from every corner of the football ecosystem.
Pitching In was up against the likes of McDonalds, Barclays, Adidas, Nike and Coca-Cola, who were among the other shortlisted nominees for the Grassroots Initiative of the Year prize. Hosted by football royalty – Jamie Carragher and Peter Crouch – the awards celebrate the visionaries, pioneers and change-makers powering world football from behind the scenes.
Stella David, CEO of Entain, said: “We are delighted to see Pitching In recognised in this manner. Football is central to our business, which is why we feel it is so important to invest in the sport at the grassroots level, playing our part in bringing clubs and their communities closer together.
“When we started this project back in 2020, non-league clubs – and English football more generally – were staring into an uncertain future amid the Covid-19 pandemic.
“The grants Pitching In provided at that time proved crucial and we have continued to grow our relationship with the more than 260 clubs, who are the backbone of the English game, over the time since. We love supporting grassroots football and are excited by how this partnership can grow and evolve further.
“We would like to thank the Northern Premier League, Isthmian League and Southern League for their continued support, along with every single volunteer who gives up their time for their local football club. The game at this level could not run without you and Pitching In will continue to do what we can to highlight your invaluable contributions.”
Carmen Alexander from the Global Football Industry Awards added: “Congratulations to Entain and all 2025 Global Football Industry Award winners.
“Our judges were impressed by the commitment Entain has shown to grassroots football over a prolonged period of time and particularly the Trident Community Fund, which continues to make a tangible difference to non-league clubs across the country. Entain is very worthy of this recognition.”
The post Entain’s Pitching In Initiative Crowned Grassroots Sports Initiative of the Year appeared first on European Gaming Industry News.
Industry News
Sky Bet Relocates Headquarters to Malta
Reading Time: < 1 minute
Sky Bet has relocated its headquarters to Malta, a move that could cut its UK tax bill by tens of millions of pounds a year. The change will mean less money for the government at a time when the public finances are under strain.
The chancellor needs to increase tax revenues and is under pressure to levy higher duties on the betting industry – something the industry is aggressively campaigning against. Sky Bet, which describes itself as “the UK’s No. 1 betting app,” has moved its sportsbetting business to the Maltese branch of a new UK company, SBG Sports Limited.
Flutter Entertainment PLC, Sky Bet’s parent company, first told staff about the move in June, alongside a plan to make around 250 people in the UK redundant. At a meeting which was live-streamed across Flutter’s “UK and Ireland” business, workers in Leeds, Sunderland, London, Dublin, Gibraltar, Porto and Cluj were told the relocation of Sky Bet to Malta was driven by a “need to operate more efficiently” and to reduce costs.
Steve Birch, chief commercial officer of Sky Betting and Gaming, said that from November 1, “day-to-day commercial and marketing decision making will take place in Malta,” although Sky Bet’s Leeds office would continue to be one of Flutter’s largest.
The post Sky Bet Relocates Headquarters to Malta appeared first on European Gaming Industry News.
-
Amusnet6 days agoAmusnet CEO Ivo Georgiev Honoured with Golden Medal by the Technical University of Sofia
-
Åland6 days agoKambi Group plc and Paf sign long-term sportsbook partnership extension
-
Balkan Entertainment & Gaming Expo6 days agoCT Interactive Unveils Latest Content at BEGE 2025
-
Balkans6 days agoEGT is among the main contenders for the prize in several categories at the BEGE Awards 2025
-
Latest News6 days agoEvenBet Gaming Presents Spins Poker: A Revolution in Online Poker
-
40 Bulky Fruits Buy Bonus6 days agoAmusnet Unveils 40 Bulky Fruits Buy Bonus: A Juicy Twist on the Classic Fruit Slot Experience
-
Australia4 days agoCrown Melbourne Fined for Exclusion Breach
-
Central Europe5 days agoOddin.gg Wins the Deloitte Technology Fast 50 Central Europe for the Second Year in a Row



