An investigation led by Noam Rotem from security firm vpnMentor revealed a data breach incident in Clubillion, a popular casino app. According to the experts of the cyber security consulting company, the breach originated due to an Elasticsearch implementation that stored the daily activity logs of millions of app users worldwide, plus some sensitive user details.
Clubillion is a free online casino app available for iOS and Android launched in 2019 and featuring millions of users. According to its Play Store profile, Clubillion is the most popular app in its class and has an average rating of 4/5.
Specialists at the cyber security consulting company mention that the database exposed contained records with game-related terms to identify the activities of Clubillion users; each time a player performed any action in the app, a record like the following was recorded:
- “enter into play”
- “win”
- “lose”
- “update account”
- “Create an account”
As the investigation progressed, new entries appeared, accumulating up to 200 million records a day. In total, the researchers found 50 GB of exposed information.
In addition to the game-related records, multiple entries contained personal information of the app’s users, including:
- IP addresses
- Emails
- Earnings
- Private messages
Regarding the scope of the data breach, users from all over the world have been affected, including inhabitants of countries such as the United States, United Kingdom, France, Israel, Germany, Italy, among others. The incident was notified to the developers, so access to this database was closed soon after.
The incident could expose app users to phishing attacks, phishing, and more, so they are advised to stay on top of any suspicious account activity or emails from unidentified users.
Specialists from the cyber security consulting company mention that betting and gambling applications are especially vulnerable to cyberattacks, as they store a lot of personal information about their users and sometimes their security is very poor. A study of 23,000 free casino applications found that at least 3,200 posed some risk to their users, plus about 380 contained security vulnerabilities, while at least 60 were hiding malware.
For further reports on vulnerabilities, exploits, malware variants and computer security risks, it is recommended to enter the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
