96 Million User Records Exposed in 1win Online Betting Platform Breach
What Happened – In November 2024 the 1win betting service disclosed that a breach exposed the personal data of 96,166,543 accounts. The leak included email addresses, IP addresses, phone numbers, dates of birth, country information and SHA‑256 password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and the need for continuous monitoring of authentication controls.
- Highlights the importance of maintaining defensible evidence that password storage, hashing, and access‑control policies meet audit expectations.
- Shows how a single data‑exfiltration event can trigger multiple regulatory notifications across jurisdictions.
Who Is Affected – Online gambling operators, their payment processors, and any downstream partners that handle the same user base (financial services, marketing platforms).
Recommended Actions
- Verify that password hashing uses a strong, salted algorithm (e.g., Argon2) and rotate all compromised credentials.
- Deploy multi‑factor authentication (MFA) for all user and administrative accounts.
- Conduct a control‑assurance review of identity‑access management (IAM) policies and collect evidence for audit readiness.
- Update breach‑notification procedures to align with applicable data‑protection regulations.
Source: Have I Been Pwned – 1win breach
Technical Notes – The breach released SHA‑256 password hashes, suggesting the attacker obtained a database dump. No specific CVE or exploit was disclosed, implying a possible insider or insufficient database segmentation. The exposed fields are typical of a credential‑theft scenario.
Source: same as above