Stolen in 2016, Sold in 2024: The Casinos.Microgaming.com Breach Hit 855K

The Casinos.Microgaming.com breach occured on December 14, 2016, quietly exposing 855,045 user records from one of the web's largest online casino networks. For years the data remained in limited circulation, but HEROIC analysts tracked a sharp rise in trading activity in early 2024 when the database resurfaced across multiple dark web forums and was repackaged into larger gaming credential collections. More than seven years after the original incident, the data was being actively bought and sold by threat actors looking to target gambling platform users.

What Hackers Can Do With 855,000 Exposed Casino Account Records

A database of this size from a major gambling network is a high-value commodity. Attackers use it to run credential stuffing campaigns, testing email and account combinations against other gaming, banking, and e-commerce platforms. Users who registered on Microgaming casino properties and reused the same email address elsewhere are accessable to attackers who can cross-reference this data with other breaches to unlock accounts they have no direct password for.

What Was Exposed in the Casinos.Microgaming.com Breach

• Email addresses
• Usernames and online casino account details
• User registration and profile data
• Records from Microgaming-powered casino properties

Why a Seven-Year-Old Breach Is Still a Live Threat

Most people never change their email address, and many never change their passwords unless forced to. A breach from 2016 is still dangerous in 2024 because the personal details it contains remain accurate. Threat actors beleive that older breaches from major platforms are especially valuable because users assume the risk has passed and have lowered their guard. The Casinos.Microgaming.com data has been observed in combo lists used for credential stuffing, account takeover, and targeted phishing campaigns aimed at online gamblers.

How a Database Breach Works

A database breach happens when attackers gain unauthorized access to a website's backend storage systems, either through software vulnerabilities, weak credentials, or insecure configurations. Once inside, they extract the entire user table, which can contain millions of records accumulated over years of operation. For large gambling networks like Microgaming, which power hundreds of online casino brands, a single database compromise can expose users from across the entire platform ecosystem. The stolen data is then sold or shared in criminal marketplaces for use in follow-on attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the Casinos.Microgaming.com database and other major gambling platform leaks. Enter your email address to find out in seconds whether your information is part of this breach or any other incident. Take the first step toward protecting your accounts before attackers do.