Industry News
MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability
Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.
The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.
Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.
Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.
The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.
Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.
What is SQL Injection?
First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.
Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.
The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.
The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.
How we found this vulnerability
Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.
What’s the impact of the vulnerability?
The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:
By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.
The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.
Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.
What to do if you’ve been affected?
If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.
However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.
Disclosure and lack of communication from BigMage Studios
Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.
We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.
Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.
Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.
The latest AskGamblers Complaint Service report for 2024 has officially been released. The comprehensive report highlights the most important accomplishments and records of the AskGamblers Complaint Service team for the previous year.
In 2024, The AGCS team (formerly known as AGCCS) managed to return $6,890,547.11 to players. Over 7259 players turn to AskGamblers, submitting complaints against 1114 casino brands. Out of all the accepted and processed complaints, the team had a 68% resolution success rate. One of the notable milestones that reached was returning a total of $70 million to the members.
Dijana Radunović, General Manager at AskGamblers, said: “It’s amazing to see the trust players put in us year after year, and we’re able to repay them by helping them recover their funds from operators or solve other related issues. We’ve had another successful year, with a few records broken and amazing milestones achieved and we can’t wait to see what lies in store in the years ahead.”
The post Players Reclaim Close to $7M Through AskGamblers Complaint Service in 2024 appeared first on European Gaming Industry News.
DigiPlus Interactive Corp. (DigiPlus) has won seven honours – including five coveted gold awards – at the 2025 Asia-Pacific Stevie Awards. This milestone places DigiPlus among the most awarded companies in the region this year, spotlighting its strategic growth and transformative impact across digital entertainment, social development and investor relations.
The Asia-Pacific Stevie Awards are the only business awards Programme that recognises innovation across all 29 markets in the region. Widely regarded as the world’s premier business awards, the Stevie Awards represent a prestigious recognition of business excellence.
DigiPlus bagged five Gold Stevies for ‘Innovative Achievement in Growth’, ‘Innovation in Investor Relations’, ‘Excellence in Social Impact Companies’, ‘Innovation in Annual Reports’ and ‘Innovation in Corporate Websites’. The company also clinched Silver and Bronze Stevies for ‘Achievement in Product Innovation’ and ‘Innovation in Brand Renovation’ respectively.
At the core of these wins is DigiPlus’ commitment to innovation and digital transformation. From redefining the player experience through localised and immersive content, to launching a refreshed brand identity that resonates with a more connected and tech-savvy user base, DigiPlus has embraced a future-forward mindset. The company’s calculated investments in big data, cutting-edge technologies and stakeholder engagement have not only fueled business growth, but also opened inclusive pathways to digital participation through its social development arm, BingoPlus Foundation.
“This momentous victory at the Asia-Pacific Stevie Awards affirms DigiPlus’ emergence as a true powerhouse of innovation and progress, reshaping industry boundaries and redefining digital consumer engagement on a global scale. Through consistent growth and business performance, DigiPlus reaffirms its unwavering commitment to creating long-term value,” said DigiPlus Chairman Eusebio Tanco.
Winning entries in the Asia-Pacific Stevie Awards undergo a rigorous, multi-layered evaluation by an esteemed panel of judges composed of business and industry leaders across the region.
“The 12th Asia-Pacific Stevie Awards received an impressive array of outstanding entries. This year’s winners have clearly shown their dedication to innovation, and we commend their resilience and imaginative efforts,” said Maggie Miller, President of the Stevie Awards.
The post DigiPlus Bags 7 Wins at the 2025 Asia-Pacific Stevie Awards appeared first on European Gaming Industry News.
Amusnet has introduced its latest promotional tool designed to enhance player engagement and boost operators’ performance. Tournaments reinforces Amusnet’s commitment to excellence, ensuring that its global network of partners can thrive in a competitive landscape and enjoy sustained success in the ever-evolving online gaming industry. With an intuitive interface, customisable tournament formats and seamless integration, this powerful tool is set to upgrade the online gaming experience and increase retention.
This versatile promotional tool enables operators to create highly engaging, dynamic tournaments that captivate players and encourage continuous participation. Whether it’s a time-limited challenge, a leaderboard-driven contest or an exclusive high-stakes competition, the tool offers complete flexibility to tailor rules, prizes and winning criteria to any gaming audience.
By implementing Tournaments, operators can enhance retention, increase activity and upscale revenue with its key features:
• Quick & Easy Setup – Create tournaments seamlessly with intuitive tools.
• Customisable Rewards – Offer cash, free spins or exclusive prizes.
• Diverse Win Criteria – Set different conditions for varied gameplay styles.
• Seamless Integration – Effortless integration into the Amusnet system for a smooth experience.
• Increased Retention & Revenue – Drive higher engagement and bets with Recurring tournaments.
Designed to boost engagement, the tool empowers operators of any scale to run dynamic, competitive events, providing endless possibilities for exciting gameplay experiences. Tournaments can be easily accessed through the newly upgraded Client Portal, where operators can request activation via the dedicated Request Form. With a seamless and efficient interface, the portal ensures partners have everything they need to optimise their gaming offerings and drive long-term success.
The post Amusnet Introduces “Tournaments” to Elevate Online Gaming Engagement appeared first on European Gaming Industry News.
-
Press Releases4 weeks agoGraffiti Rush marks PG Soft’s debut in graffiti-themed slots
-
Baltics2 weeks ago
Playson powers ahead in Europe with Fenikss partnership
-
Latin America3 weeks ago
Paysecure expands reach across LATAM, showcasing solutions at SIGMA Americas
-
Africa3 weeks ago
Springbok Casino is Offering 25 Free Spins in Honour of South Africa’s Top 5 Wild Egg Hunters
-
Amusnet3 weeks ago
Amusnet to Participate in the Third Edition of SiGMA Americas
-
Balkans4 weeks ago
7777 gaming partners with LiveScore to elevate its new operations in Bulgaria
-
Central Europe3 weeks ago
Digitain Partners with Gamingtec to Expand Presence in Europe
-
Arnold Sports Festival South America 20254 weeks ago
SCCG Sponsors Arnold Sports Festival South America 2025
