Paddy Power Exposes Nearly 600 K Customer Records in Delayed Disclosure Breach
What Happened
In October 2010 the Irish bookmaker Paddy Power suffered a data breach that compromised the personal information of approximately 590,954 customer accounts. The breach, which included names, addresses, phone numbers, email addresses, dates of birth, account balances, security questions and answers, and website activity, was not publicly disclosed until July 2014.
Why It Matters for Compliance & Audit Readiness
- Timely detection & reporting – A continuous control‑assurance program would flag anomalous data access and enforce the 72‑hour breach notification window required by GDPR and other regulations.
- Defensible evidence – Maintaining immutable logs and forensic snapshots enables auditors to verify that the organization had appropriate monitoring, containment, and response procedures in place.
- Identity‑theft mitigation – Controls that encrypt sensitive fields (e.g., security answers) and enforce strong authentication reduce the downstream impact of exposed credentials.
Who Is Affected
- Online gambling and sports‑betting platforms
- Financial‑service providers that share marketing or payment integrations with the bookmaker
- Any third‑party services that stored or processed Paddy Power customer data (e.g., analytics, email marketing)
Recommended Actions
- Review all contracts and data‑processing agreements with Paddy Power and any downstream vendors for breach‑notification clauses.
- Validate that continuous monitoring controls (log aggregation, UEBA, DLP) are active and that alerts are reviewed within defined SLAs.
- Request a detailed incident‑response report from Paddy Power, including timeline, root‑cause analysis, and remediation steps.
- Conduct a risk assessment for the exposed data types (PII, security answers) and initiate identity‑theft protection measures for affected customers.
Technical Notes
- Attack vector: Unauthorized access to the customer database (specific technique not disclosed).
- CVE identifiers: None reported.
- Data types exposed: Account balances, dates of birth, email addresses, IP addresses, names, phone numbers, physical addresses, security questions and answers, usernames, website activity.
Source: https://haveibeenpwned.com/api/v3/breach/PaddyPower