Gamblers’ data compromised after casino giant Strendus fails to set password
November 15, 2023
Mexican online casino Strendus has exposed sensitive user data, including home addresses and the amounts of money they spent on gambling.
Strendus, one of the biggest online casinos in Mexico has exposed sensitive user data, including home addresses and the amounts of money they spent on gambling. The data was likely compromised by unauthorized actors.
The Cybernews research team discovered that Strendus, a Mexican-licensed online casino, had left public access to 85GB of its authentication logs, with hundreds of thousands of entries containing private gamblers’ data. The open instance also contained data from another online casino, MustangMoney.
- Usernames
- Names
- Government ID numbers (CURP)
- Phone numbers
- Email addresses
- Home addresses
- Dates of Birth
- Gender
- KYC status
- IP addresses used to register for an account
- IP addresses used to log in
- Deposit amounts
- Withdrawal amounts
- Notes on users, submitted by admins and customer support agents.
In the Elasticsearch instance, researchers stumbled upon 16 indices named “hacked[_id]” that are likely Indicators of Compromise (IoC). IoCs are pieces of evidence or data that suggest a security incident or breach has occurred. For example, it could be a sign of unauthorized access to the logs.
The fact that these indices were discovered suggests that the instance was not under regular monitoring, putting users at risk. This is particularly concerning, as casinos store a significant amount of customer data, making them attractive targets for cybercriminals.
The two platforms collected extensive amounts of user data to follow Mexican gambling laws and comply with Know Your Customer (KYC) regulations, used to verify the identity of users to prevent fraud, money laundering, and other illegal activities.
Our researchers discovered the open instance on April 7th and promptly informed the company that owns the gambling platforms. However, the instance remained open until mid-October, leaving the user data publicly accessible for an extended period of time. The data was first indexed by IoT devices on March 8th, 2023.
Cybernews contacted the company for an official comment but has yet to receive a response.
Cybersecurity neglect endangers gamblers
Failure to properly set authentication poses significant risks, as merely knowing the website’s domain is enough for an attacker to access user data.
The private user data was found in activity logs showing poor cybersecurity practices. Storing personal information in logs should be avoided, as it elevates their sensitivity level.
The information exposed in this data leak could have been exploited for fraud, identity theft, phishing attempts, or as a source of data for meticulously targeted cyberattacks.
Leaked CURP numbers, in combination with other personal information, could be used to open bank accounts or make unauthorized changes on government websites on behalf of the CURP number holder. Admins’ notes on users present in leaked logs may also help malicious actors build a profile and better target users through spearphishing or other social engineering attacks.
The exposed phone numbers can be exploited for spam, malware and spyware attacks, SIM swapping, and the discovery of user accounts on platforms like WhatsApp, Signal, and others.
The leaked IP addresses introduce the risk of a takeover of a local network. IP addresses are used to ensure that internet communications are sent and received by the intended device. If attackers know the IPs, they could launch DDoS attacks and search for open ports, which, if found, could potentially grant access to the local network and the devices connected to it.
Staying safe
People that have used Strendus or MustangMoney services recently should read recommendations provided by CyberNews to mitigate the risks, below is the original post:
https://cybernews.com/security/strendus-casino-data-leak/
About the author: Paulina Okunytė Journalist at CyberNews
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Strendus)