Gamblers’ data compromised after casino giant fails to set password

One of the biggest online casinos in Mexico has exposed sensitive user data, including home addresses and the amounts of money they spent on gambling. The data was likely compromised by unauthorized actors.

The Cybernews research team discovered that Strendus, a Mexican-licensed online casino, had left public access to 85GB of its authentication logs, with hundreds of thousands of entries containing private gamblers’ data. The open instance also contained data from another online casino, MustangMoney.

• Usernames
• Names
• Government ID numbers (CURP)
• Phone numbers
• Email addresses
• Home addresses
• Dates of Birth
• Gender
• KYC status
• IP addresses used to register for an account
• IP addresses used to log in
• Deposit amounts
• Withdrawal amounts
• Notes on users, submitted by admins and customer support agents.

In the Elasticsearch instance, researchers stumbled upon 16 indices named “hacked[_id]” that are likely Indicators of Compromise (IoC). IoCs are pieces of evidence or data that suggest a security incident or breach has occurred. For example, it could be a sign of unauthorized access to the logs.

The fact that these indices were discovered suggests that the instance was not under regular monitoring, putting users at risk. This is particularly concerning, as casinos store a significant amount of customer data, making them attractive targets for cybercriminals.

The two platforms collected extensive amounts of user data to follow Mexican gambling laws and comply with Know Your Customer (KYC) regulations, used to verify the identity of users to prevent fraud, money laundering, and other illegal activities.

Our researchers discovered the open instance on April 7th and promptly informed the company that owns the gambling platforms. However, the instance remained open until mid-October, leaving the user data publicly accessible for an extended period of time. The data was first indexed by IoT devices on March 8th, 2023.

Cybernews contacted the company for an official comment but has yet to receive a response.

Cybersecurity neglect endangers gamblers

Failure to properly set authentication poses significant risks, as merely knowing the website's domain is enough for an attacker to access user data.

The private user data was found in activity logs showing poor cybersecurity practices. Storing personal information in logs should be avoided, as it elevates their sensitivity level.

The information exposed in this data leak could have been exploited for fraud, identity theft, phishing attempts, or as a source of data for meticulously targeted cyberattacks.

Leaked CURP numbers, in combination with other personal information, could be used to open bank accounts or make unauthorized changes on government websites on behalf of the CURP number holder. Admins’ notes on users present in leaked logs may also help malicious actors build a profile and better target users through spearphishing or other social engineering attacks.

The exposed phone numbers can be exploited for spam, malware and spyware attacks, SIM swapping, and the discovery of user accounts on platforms like WhatsApp, Signal, and others.

The leaked IP addresses introduce the risk of a takeover of a local network. IP addresses are used to ensure that internet communications are sent and received by the intended device. If attackers know the IPs, they could launch DDoS attacks and search for open ports, which, if found, could potentially grant access to the local network and the devices connected to it.

Staying safe

Have you used Strendus or MustangMoney services recently? Cybernews advises affected users to take the following actions to mitigate the risks:

• Since CURP numbers can not be changed, if you were affected by the leak, you should monitor for any unauthorized changes on government websites, keep an eye on your credit score, and ensure that all accounts that use this number are using strong passwords and two-factor authentication (2FA).
• You should change your email password. Strong passwords should be unique, have not been used before, be at least 12 symbols long, and contain uppercase and lowercase letters and special symbols. It is easy to create strong passwords using a unique password generator tool.
• Even though the credentials were not exposed, leaked emails could pose a risk of credential-stuffing attacks against Strendus casino accounts, as threat actors could use the leaked data from previous breaches. You can use a leaked password-checking tool to know if any of your passwords were leaked online. Make sure that the leaked passwords are not reused on any of your accounts.
• Leaked email addresses can be used to send unsolicited communications, such as spam or phishing emails. You should be wary of receiving such emails and not click any suspicious links in emails.
• You should ensure that all accounts connected to a leaked phone number are secured with strong passwords and 2FA.
• To increase security, switch to using time-based one-time passwords (TOTP) instead of SMS-based 2FA or change the phone number.
• If you believe that you may be at an increased risk of direct cyber attacks, it's advisable to contact your internet service provider and request a change in your IP address to safeguard your local network.