Latest News

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Published

5 years ago

October 22, 2020

George Miller

MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Reading Time: 3 minutes

Attackers could exploit the SQL Injection flaw to compromise the game’s database and steal user data.

The CyberNews.com Investigation team discovered a critical vulnerability in Street Mobster, a browser-based massively multiplayer online game created by Bulgarian development company BigMage Studios.

Street Mobster is a free to play, browser-based online game in the mafia empire genre where players manage a fictional criminal enterprise. The game boasts a 1.9+ million player base and stores a user record database that can be accessed by threat actors by committing an SQL Injection (SQLi) attack on the game’s website.

Other games created by BigMage Studios are also potentially vulnerable to the same type of attack, which means that there is a possibility that even more users might be at risk.

The records that can be compromised by exploiting the SQLi vulnerability in Street Mobster potentially include the players’ usernames, email addresses, and passwords, as well as other game-related data that is stored on the database.

Fortunately, after we reported the vulnerability to BigMage Studios, CERT Bulgaria, and the Bulgarian data protection authority, the issue has been fixed by the developers and the user database is no longer accessible to potential attackers.

What is SQL Injection?

First found back in 1998, SQLi is deemed by the Open Web Application Security Project (OWASP) as the number one web application security risk.

Even though this vulnerability is relatively easy to fix, researchers found that 8% of websites and web applications are still vulnerable to SQLi attacks in 2020. Which, from a security perspective, is inexcusable. So much so, in fact, that UK internet service provider TalkTalk was hit with a record £400,000 fine over succumbing to a cyberattack that involved SQLi.

The vulnerability works by injecting an unexpected payload (a piece of code) into the input box on the website or in its URL address. Instead of reading the text as part of the URL, the website’s server reads the attacker’s payload as code and then proceeds to execute the attacker’s command or output data that would otherwise be inaccessible to unauthorized parties. Attackers can exploit SQLi even further by uploading pieces of code or even malware to the vulnerable server.

The fact that Street Mobster is susceptible to SQLi attacks clearly shows the disappointing and dangerous neglect of basic security practices on the part of the developers at BigMage Studios.

How we found this vulnerability

Our security team identified an SQL Injection vulnerability on the Street Mobster website and were able to confirm the vulnerability by performing a simple command injection test on the website URL. The CyberNews team did not extract any data from the vulnerable Street Mobster database.

What’s the impact of the vulnerability?

The data in the vulnerable Street Mobster database can be used in a variety of ways against the players whose information was exposed:

By injecting malicious payloads on Street Mobster’s server, attackers can potentially gain access to said server, where they can install malware on the game’s website and cause harm to the visitors – from using the players’ devices to mine cryptocurrency to redirecting them to other malicious websites, installing malware, and more.

The 1.9 million user credentials stored on the database can net the attackers user email addresses and passwords, which they can potentially use for credential stuffing attacks to hack the players’ accounts on other gaming platforms like Steam or other online services.

Because Street Mobster is a free-to-play game that incorporates microtransactions, bad actors could also make a lot of money from selling hacked player accounts on gray market websites.

What to do if you’ve been affected?

If you have a Street Mobster account, make sure to change your password immediately and make it as complex as possible. If you’ve been using your Street Mobster password on any other websites or services, change that password as well. This will prevent potential attackers from accessing your accounts on these websites in case they try to reuse your password for credential stuffing attacks.

However, it’s ultimately up to BigMage Studios to completely secure your Street Mobster account against attacks like SQLi.

Disclosure and lack of communication from BigMage Studios

Following our vulnerability disclosure guidelines, we notified the BigMage Studios about the leak on August 31, 2020. However, we received no reply. Our follow-up emails were left unanswered as well.

We then reached out to CERT Bulgaria on September 11 in order to help secure the website. CERT contacted the BigMage Studios and informed the company about the misconfiguration.

Throughout the disclosure process, BigMage Studios stayed radio silent and refused to get in touch with CyberNews.com. Due to this reason, we also notified the Bulgarian data protection agency about the incident on October 9 in the hopes that the agency would be able to pressure the company into fixing the issue.

Eventually, however, BigMage Studios appear to have fixed the SLQi vulnerability on streetmobster.com, without informing either CyberNews.com or CERT Bulgaria about that fact.

Source

Source: Latest News on European Gaming Media Network
This is a Syndicated News piece. Photo credits or photo sources can be found on the source article: MMO game Street Mobster leaking data of 1.9 million users due to critical vulnerability

Related Topics:gambling industry in Europe

George Miller

George Miller (Gyorgy Molnar) started his career in content marketing and has started working as an Editor/Content Manager for our company in 2016. George has acquired many experiences when it comes to interviews and newsworthy content becoming Head of Content in 2017. He is responsible for the news being shared on multiple websites that are part of the European Gaming Media Network.

Prague Gaming & TECH Summit 2025 (25-26 March)

Click to comment

You must be logged in to post a comment Login

You must be logged in to post a comment.

Latest News

From ‘Mummyverse’ to Crash Games: Belatra Reviews a Landmark 2025

Published

3 days ago

December 23, 2025

George Miller

Editor’s Take

Why this matters: Belatra has been a steady hand in the slots world for a long time, but 2025 marked a distinct shift in strategy. By entering the Crash vertical with Goose Boom Bang and winning big at SiGMA Africa, the studio is clearly pivoting to capture the high-growth, high-frequency players in emerging markets. They are no longer just a “classic slots” developer; they are diversifying the portfolio to ensure relevance in regions like LatAm and Africa.

The Full Story

Belatra Games, the specialist online slots developer, has issued a strategic review of its 2025 operations, celebrating a 12-month period defined by entry into new game verticals, significant franchise expansion, and high-profile industry recognition.

The year was characterized by a dual strategy: deepening engagement in established markets while aggressively expanding its content portfolio to suit local preferences in emerging territories.

Portfolio Evolution: Crash and Battles 2025 saw Belatra move beyond its traditional slot roots. The company made its debut in the high-demand Crash game vertical with the launch of Goose Boom Bang, a title designed to tap into the fast-paced gameplay preference of younger demographics.

Additionally, the studio introduced a fresh game concept with the launch of Battles, a new format unveiled for the first time in 2025, with further development planned for 2026.

The ‘Mummyverse’ Expands For fans of classic slots, the highlight of the year was the aggressive expansion of the Mummyverse. Belatra nearly doubled the size of this franchise over the year, making it the most extensive game universe in their entire catalog.

The developer also focused on B2B localization, releasing a number of exclusive bespoke games created specifically for selected operator partners to meet specific local market tastes.

Awards and Recognition The company’s strategic shifts were validated by industry accolades. Belatra secured over 30 nominations throughout the year, with standout wins including:

Best Slot Provider (awarded by BitStarz).
Most Played Game of 2025 for Make It Gold at the SiGMA Africa Awards.
Player’s Pick Award.

Management Commentary Misha Voinich, Head of Business Development at Belatra, commented on the studio’s momentum:

“This year has truly defined who we are as a studio – ambitious, creative and focused on building long-term partnerships. We’ve expanded our universes, launched new ones and entered exciting new markets that will all help us carry this momentum into the New Year.”

The post From ‘Mummyverse’ to Crash Games: Belatra Reviews a Landmark 2025 appeared first on Gaming and Gambling Industry Newsroom.

Latest News

‘Chaos and Soul’: Ebaka Games Plots Global Expansion After Viral Launch

Published

3 days ago

December 23, 2025

George Miller

Editor’s Take

Why this matters: The “Instant Game” vertical (Crash, Plinko, Mines) is becoming crowded, but Ebaka Games is cutting through the noise with a distinct brand personality. By securing BMM Testlabs certification so quickly after launch, they are signaling to Tier 1 operators that despite their “chaotic” marketing vibe, the math underneath is solid and compliant. The backing of industry veteran Dmitry Belianin also adds immediate commercial credibility to the startup.

The Full Story

Ebaka Games, the fledgling studio that promises to bring “chaos and soul” to the iGaming sector, has outlined an aggressive growth strategy for 2026 following a landmark launch period in late 2025.

The studio, which officially debuted in November, reports that its initial rollout reached more than five million people worldwide. The launch saw its portfolio go live with the operator Menace, serving as the initial testbed for its mechanics and “Ebaka modes.”

The Product: Instant Games with Personality Ebaka is bypassing traditional slots to focus on the high-growth vertical of fast-paced, instant-win games. Their initial lineup includes:

Plinko
Mines
Tower
Limbo
Crash

Differentiation is achieved through unique mascots and signature gameplay tweaks designed to offer high win potential and distinct visual identities, moving away from the generic interfaces often found in this genre.

Regulatory Milestone Crucially for its 2026 roadmap, Ebaka Games has confirmed it has secured certification from BMM Testlabs. This accreditation validates the fairness and integrity of its RNG (Random Number Generator) and game engines, removing a major barrier to entry for regulated markets. With this certification in hand, the studio plans to launch with a number of “major brands” in the coming year.

Management Commentary Vitalii Zalievskyi, CEO of Ebaka Games, commented on the studio’s unorthodox approach:

“It’s only been a few weeks since we first introduced Ebaka Games to the world. The feedback has been breathtaking, and it vindicates the decision for us to take a different path to the rest of the industry. You don’t need huge marketing budgets to grab people’s attention if you are building something truly innovative.”

Industry Backing The studio describes itself as being “created by players for players” but boasts significant industry firepower in its corner. The team includes Dmitry Belianin, a well-known figure in the sector who is the co-founder of Blask and Menace, as well as Managing Partner at Already Media.

The post ‘Chaos and Soul’: Ebaka Games Plots Global Expansion After Viral Launch appeared first on Gaming and Gambling Industry Newsroom.

Latest News

Racing Meets Nightlife: SBK Backs ARC’s New ‘Friday Night Live’ Series

Published

3 days ago

December 23, 2025

George Miller

Editor’s Take

Why this matters: British racing has a well-documented demographic problem; its core audience is aging. “Friday Night Live” is a direct attempt to fix this by blending high-stakes racing with the “experience economy” (DJs, nightlife vibes) that appeals to Gen Z and Millennials. Bringing SBK on board—a mobile-first, app-only sportsbook—is a perfect demographic fit, while the Racing Post adds the necessary credibility to ensure the actual racing product remains the focus.

The Full Story

Arena Racing Company (ARC) has unveiled the strategic commercial lineup for its upcoming Friday Night Live series, confirming SBK as the Exclusive Betting Partner and The Racing Post as the Official Media Partner.

Set to launch in January 2026, Friday Night Live is a new initiative created in collaboration with youth-focused events company INVADES. The series is designed to overhaul the traditional race day experience, featuring fast-paced fixtures under floodlights, DJ sets, and significant entertainment elements sandwiched between races.

The Commercial Deal

SBK: As the exclusive betting partner, the Smarkets-owned sportsbook will take naming rights and on-course branding for all 35 races. Crucially, these races will be broadcast live on mainstream television via ITV Racing as well as Sky Sports Research.
The Racing Post: As the Official Media Partner, the publication will provide content, coverage, and promotion across its digital platforms, aiming to bridge the gap between established racing purists and the new audience ARC hopes to attract.

A High-Stakes Experiment The series is not just a marketing exercise; it carries serious sporting weight. Each of the five scheduled nights will feature over £200,000 in prize money. The fixtures will rotate across three of ARC’s all-weather tracks: Wolverhampton, Newcastle, and Southwell.

Management Commentary David Leyden Dunbar, Group Director of Commercial Strategy at ARC, was clear about the target audience:

“We have been very clear that one of the aims of Friday Night Live is to engage the next generation of racing fans… Both [partners] have shown real enthusiasm to work with us… as well as using the platform that these fixtures will offer them to also engage with more established racing and sports fans.”

Adam Baylis, Marketing Director at SBK, added:

“Friday Night Live [is] a fresh and engaging concept that brings a new energy to British racing. SBK has always been built around sport… our focus is on enhancing the live race day experience in a fun, social and responsible way.”

The 2026 Schedule The series kicks off immediately in the new year: