Russian bookmakers have been forced to publicly deny that their customers’ sensitive information has been hacked and offered for sale to the highest bidder.
The kerfuffle began last week when Dmitry Sergeyev, CEO of bookmaker Digital Betting, posted a note to his Facebook page saying one of the country’s largest bookmakers had been hacked and that the hackers were looking to sell the customer data, including hashed passwords, for 200 Bitcoin (US $146,500).
The hacked data also included answers to security questions. The Bookmaker-Ratings.ru affiliate site claimed this narrowed the field of possible operators to Marathon, Liga Stavok, Zenit, Parimatch and Olimp, with Marathon being the most likely candidate of this group to have a 1m strong database.
Marathon, which generally ranks second on Russian online bookmaker traffic reports, publicly refuted the suggestion that its systems had been hacked, issuing a statement stressing the strength of its online security protocols and assuring customers that they need not be alarmed as to the safety of their personal data.
On Monday, the allegedly purloined data appeared on Joker.buzz, aka The Exchange of Information, an online auction site dedicated to the sale and exchange of data hacked from (usually) Russian politicians and businessmen. The site has been linked to the group that hacked Prime Minister Dmitry Medvedev’s Twitter account in 2014.
A party on Joker.buzz claimed to be auctioning a data set drawn from the “largest bookmaker” in Russia. The seller singled out Liga Stavok as the source of the data, which reportedly includes 1.4m records, of which around 400k date from 2016. The auction closes on February 1, 2017, although you can buy the lot now for 300 Bitcoin ($220k).
Liga Stavok issued a hot denial, saying internal audits had revealed no evidence of any breaches in their systems and that the data listed on Joker.buzz had no relation to their business. Liga Stavok further claimed that the Joker.buzz posting could be a “deliberate attempt to discredit” Liga Stavok through “the spread of false information.”
Liga Stavok, which received the first official Russian online betting license this spring, suggested that this attempt to discredit may have been made by “unscrupulous market participants whose shady business is not as successful, but in the new environment in general is under the threat of liquidation.”
On Tuesday, a Joker.buzz spokesperson told Bookmakers-Ratings.ru they couldn’t vouch for the authenticity of the data, as they only act as an intermediary between buyer and seller. However, they did say that if the buyer finds that the data doesn’t match the seller’s description, the site has the power to withhold payment.
