Betfair Admits to Customer Data Security Breach

Betting exchange Betfair has been under increased scrutiny this week after details emerged about an incident where criminals gained access to the credit and debit card details of nearly 2.3 million Betfair customers.

The news was all the more damaging due to the timing of the leak. It was revealed that the theft took place in March and April of 2010 – just months before Betfair went public on the London Stock Exchange in October of last year. Not only did Betfair not make the more than 3 million customers with accounts on the site aware of the security breach, it also failed to make any significant note of the incident in the prospectus for their initial public offering.

According to a report in The Telegraph, there was just one sentence in the 244 page prospectus that so much as referenced the incident. In a 13-page section on risk factors, one heading read “Failure to adequately protect customer account information could have a material adverse effect on Betfair.” One sentence in the section mentioned “a limited number of security breaches in the past,” but when on to say that they were essentially inconsequential.

The attack on Betfair’s systems initially took place on March 14, 2010. The incident was not discovered until May, when a server crash at the Malta data centre revealed that data had been compromised. According to Betfair, 3.15 million usernames were compromised, along with their security questions. About 2.9 million of those usernames had one or more physical addresses associated with them; perhaps more concerning, about 90,000 accounts had bank account details compromised.

According to a Betfair spokesman, the incident did not result in any harm to their customers, as all of the stolen data was encrypted.

“Eighteen months ago we were subject to an attempted data theft,” the spokesman said. “Because of our security measures, the data was unusable for fraudulent activity and we were able to recover the data intact. At the time, we contacted all the relevant authorities and worked closely with them regarding this matter and it was established that there was no risk to customers.”