for early access to the latest igaming videos!
and get the latest igaming news first!
Online crypto casino Stake.com has sent out emails to customers that limited user data was exposed following a security breach at one of its third-party service providers, Mixpanel.
According to Stake, the incident did not involve unauthorized access to its own platform or infrastructure, and user funds and passwords remain secure.
Third-Party Breach, Not Stake Infrastructure
The breach originated within Mixpanel, an analytics provider used by Stake and numerous other companies. Stake emphasized that Mixpanel does not have access to Stake’s core infrastructure, and the incident was fully contained within Mixpanel’s systems.
Stake stated that its platform and infrastructure were not accessed, adding that there is no evidence of compromise to account credentials or financial information.
What Happened
Mixpanel was breached through an SMS phishing (smishing) attack, which allowed an attacker to gain unauthorized access to Mixpanel’s internal systems. The incident was detected and stopped over the same weekend.
However, Mixpanel later confirmed that the attacker was able to export files containing user profile data from multiple companies, including Stake, before the breach was fully contained.
Data Potentially Exposed
Mixpanel has confirmed that the following Stake user information was included in the accessed data:
Username
Email address
Date of birth
Phone number
No passwords, authentication credentials, or financial data were involved.
Stake has implemented online monitoring services to watch for any further exposure or misuse of the data.
Actions Taken
Stake says it has taken the following steps in response to the incident:
Verified that its own systems were not impacted
Confirmed that Mixpanel has fully contained the breach
Ensured that Mixpanel has secured its systems
Mixpanel is currently working with law enforcement authorities as part of the ongoing investigation.
Security Advice for Users
While emphasizing that accounts and funds remain secure, Stake has urged users to remain vigilant against potential impersonation or phishing attempts.
The company recommends adding passkeys to accounts where possible, or enabling two-factor authentication if passkeys are unavailable.
Additional safety guidance includes:
Being cautious of emails or messages claiming to be from Stake
Remembering that Stake will never request passwords or 2FA codes
Keeping devices and operating systems fully updated
Industry Reminder on Third-Party Risk
The incident comes only months after Shuffle.com also reported a data breach, which iGamingToday previously covered. Together, the cases underline the growing cybersecurity challenges facing iGaming operators and the increasing risks associated with third-party service providers, even when core platforms remain uncompromised.
Stake says it will continue to monitor the situation and provide updates if necessary.
