Casino Data Jackpot – For Hackers: Merkur’s API Disaster
A couple of days ago, I saw a Mastodon post from Lilith Wittmann in my timeline. She linked to an article on her Medium page detailing a catastrophic security failure at Merkur AG. You can find the original Mastodon post here.
The casino company Merkur AG and its service providers have made almost all the data available in their casino systems publicly accessible. This includes payment data, gaming sessions, and copies of the ID cards of over one million players.
Lilith Wittmann’s Medium Post (German)
Oh wow. Losing data of a million customers is bad enough. To make things worse, they also integrated third-party services like Sumsub for Know Your Customer (KYC) checks. So, the leak also includes over 70,000 ID photos, selfies and proof of address from the KYC process.
A perfect setup for identity theft. What a mess!
All this was possible due to a unprotected GraphQL API endpoint.
Let’s learn from this!
For Merkur it is a massive damage. For us it is a lesson we can learn from: This breach is a good example of why securing APIs should be a top priority. Some simple steps that could have prevented this:
- Never expose internal APIs to the public internet unless absolutely necessary. If an API must be public, it should have strict access controls, rate limits and maybe even IP-restrictions.
- Put sensitive systems in a private subnet. Even if an API is misconfigured, at least it won’t be wide open to the world.
- Use proper authentication, authorization, and role-based access control. A single user or role should never have unrestricted access to all sensitive data. Access should be limited to only the necessary fields for a given role.
- Regular security audits. If you’re handling sensitive data, you better have security experts regularly pentesting your systems.
Obviously, a lot went wrong here. Let’s try to do better and avoid this kind of disaster in our own projects.
https://www.locked.de/casino-data-jackpot-for-hackers-merkurs-api-disaster/
#hacking #IdentityTheft #Merkur #MerkurBreach #Privacy
