Identity Theft Got Easier After the FREEbets Breach: 2,254 Accounts at Risk

HEROIC analysts found a dataset tied to FREEbets, a UK-based sports betting platform, posted on a popular cybercrime forum on January 5, 2023. The breach affected over 723,000 records in total, with more than 2,254 unique accounts exposed. The leaked data includes email addresses, usernames, IP addresses, and PHPass hashed passwords belonging to users of the platform.

Why This Is Dangerous

PHPass hashed passwords can be cracked with relatively modest computing power, especially when users pick common or short passwords. Once cracked, those passwords become immediately useful for breaking into other accounts. FREEbets users who reused their password across email, banking, or other gambling sites are at serious risk. The combination of email, username, and hashed password also makes this dataset highly valuable to criminals who specialize in account takeover attacks.

What Was Exposed

The following data types were confirmed in the FREEbets breach:

• Email Address
• Password Hash (PHPass)
• Username
• IP Address

Why This Matters

Gambling platform users are frequent targets for account takeover fraud because their accounts are often linked to payment methods and withdrawl balances. Once a criminal cracks a password hash or finds a match from another breach, they can drain funds, place fraudulent bets, or lock the real user out entirely. Exposed email and username combinations are also fed into automated credential stuffing tools that test thousands of accounts per hour across popular websites. A single breach like this can trigger a cascade of fraud across entirely unrelated services.

How Database Breaches Work

A database breach happens when an attacker successfully extracts stored records from a website or application's backend. Common entry points include outdated software with known security holes, misconfigured server permissions, and SQL injection vulnerabilities in login or search forms. Once access is gained, the attacker can export entire user tables in a matter of minuets. The stolen data is then packaged and posted on dark web forums where other criminals pay for or freely download it to use in their own attacks.

Check If You Are Affected

If you ever had an account on FREEbets, your email address and password may have been leaked in this breach. HEROIC's free scanner searches more than 400 billion exposed records, including this breach, to tell you exactly what information of yours is out there. Check your email now and find out before someone else uses your data against you.