Dear Customer,
We at Leo Vegas plc (‘LVG’) are committed to protecting your privacy and protecting your personal data.
On 5th July 2019, through our internal fraud detection and security tools, we noticed a login trend indicating a possible security incident on a small number of accounts.
As a precautionary measure, your account was immediately locked pending a security risk investigation to safeguard your data and other interests.
We have now completed the investigation and we would like to inform you of its outcome.
SUMMARY OF INCIDENT AND SUGGESTION TO CHANGE PASSWORD:
Our investigation has so far revealed that an unauthorised and unidentified third party, not affiliated with LVG in any way, retrieved log in credentials, most likely from illegal online forums unrelated to LeoVegas, in this case, email addresses and passwords, of some of our customers. This information has been used by the said third party to try to access a number of accounts on LeoVegas.com and since there was a match with some of the account details of our customers, we have confirmed that there has been unauthorised access to a number of accounts, including yours.
As a consequence of the above, we now urge you to immediately change your password.
We have temporarily locked your account for added security and kindly request you to contact our Support Team on
dpo@leovegas.com or privacy@leovegas.com. We will then be able to unlock your account and help you reset your password.
As an additional safety precaution, we would suggest that you change your password for other internet services where it is being used. We suggest that you refrain from ever using the old password mentioned above and ensure that the new password is not used anywhere else and contains upper and lowercase, numeric and special characters.
For a more detailed account of what has happened, please see below.
WHAT HAPPENED EXACTLY?
On 5th July 2019, our systems indicated trends that showed illicit third-party activity which includes possibly gaining unauthorized access to some of our customers’ accounts. Your account has been flagged as one of the impacted accounts.
After an internal investigation, we ascertained that in all probability the said third party accessed the accounts, not through any breach or vulnerability in our IT systems, but by obtaining leaked users’ credentials elsewhere on the
internet.
This situation may happen when, for instance, an individual chooses to use the same username and password to access various different services or accounts with different companies or service providers. If one of these multiple accounts is breached, and those credentials are leaked, unauthorized third parties may gain access to all th e other users’ accounts that he/she may have elsewhere using the same username and password. Unfortunately, it is quite common for unscrupulous individuals to seek out and possibly harvest such generic usernames and passwords with the scope of gaining entry to one or more accounts. On the basis of all the information we have, we believe this is how the affected LVG accounts were accessed, and not in any manner whatsoever as a result of LVG’s acts or omissions.
WHY IS LeoVegas.com INVOLVED?
Whilst we have confirmed that there is no security vulnerability in our systems, we feel that in the interest of transparency, you should be informed about this incident. This will enable you to take all necessary steps to better protect your personal data. As stated above, you should, at the very least change your current password and ensure to never use the same password again (including with other online services not offered by or affiliated with LVG).
This is also in line with our legal obligations under data protection laws and regulations and internal good practice rules.
WHAT IS THE IMPACT?
We have confirmed that a number of user accounts were accessed unlawfully. We have established that information on user account balances was accessed. Furthermore, it cannot be excluded that the following personal data may have been accessed through the said user accounts:
Cash balance, Bonuses, VIP level, Betting History, Personal Info (Name, email, Address, Country, mobile number), communication settings, and the last four digits of the payment method (which cannot be used without the remaining digits).
We take such incidents seriously, since the unlawful access to such personal data may have adverse consequences to data subjects, depending on what personal data was accessed, including disclosure of your identity.
WHAT ACTIONS WERE TAKEN?
In order to mitigate the above consequences and any unauthorized access that may have taken place, we have taken a number of actions such as temporarily locking all affected customers’ accounts, disabling automatic withdrawals and enhancing our anti-fraud login detection systems. As we continue to investigate, we are constantly monitoring activity on our systems with a view to taking action on any suspicious activity.
To ensure this situation is handled completely above board, we have also notified relevant authorities, including the relevant data protection Supervisory Authority – Information and Data Protection Commissioner in Malta.
We will fully cooperate with these authorities in so far as our assistance may be required.
IMPORTANT TO REMEMBER
This incident did not originate with and was not caused by us. Information that you entrust with us (such as your credentials, etc.) are kept secure by means of all the appropriate technical and organisational measures that we implement within our entire organisation. For example, your username and password are stored by us in encrypted form and as such, they cannot be retrieved from LeoVegas.com and/or used to access accounts elsewhere. In fact, this incident did not in any way result from any act or omission on our part. This notwithstanding, we are fully committed to protecting your personal data (in our capacity of data controller) and we will keep on investigating this matter and updating you further as may be required.
As a rule of good practice, we once again strongly recommend that you always use different credentials when signing up to or accessing different online services. This precautionary measure makes it considerably harder for third parties from maliciously retrieving your account information and attempting (and in some cases succeeding) to access one or more of your online accounts.
Finally, remember to change your passwords as regularly as possible.
QUESTIONS?
Please feel free to contact customer support service with any questions you may
have.
You may read our privacy policy here https://www.leovegas.com/privacy-policy Our data protection officer may be contacted on xxxxxxxxxx should you have any further questions.
xxxxxxxxx
LeoVegas Team
Ich sehe das doch richtig, dass Leovegas einen unbefugten Zugriff Dritter auf vereinzelte Accounts eingeräumt hat, oder? Wäre das nicht genug um bei Barclay einen Chargeback wegen unerlaubter Zahlungen auszulösen?
Ich hatte Barclaycard was das angeht eigentlich als sehr professionell und kundenorientiert in Erinnerung. War aber auch schon 2011. reklamierte Beträge wurden in kurzer Zeit gutgeschrieben. Habe eine neue Karte bekommen und musste eine eidesstattliche Erklärungen unterzeichnen. Als Beweis, dass ich zum Zeitpunkt der Belastung nicht in Israel war sondern den USA habe ich das Flugticket vorgelegt. Was aber auch Unsinn war, denn man konnte ab den Umsätzen ja sehen, dass ich dort war. Damit war der Fall abgeschlossen. Nie wieder was gehört.
Ist das nicht de facto nur ein Stück Papier? Eine eidesstaatliche Erklärung macht doch nur Sinn, wenn sie von einem Amtsträger abgenommen wird.musste eine eidesstattliche Erklärungen unterzeichnen.
Ist das nicht de facto nur ein Stück Papier? Eine eidesstaatliche Erklärung macht doch nur Sinn, wenn sie von einem Amtsträger abgenommen wird.
Mitnichten. Es ist absolut üblich, dass Opfer von Kartenmissbrauch derartige Erklärungen abgeben müssen, damit sie ihren Schaden erstattet bekommen. Erweisen sie sich später als falsch, dann reden wir nicht nur noch von Betrug und der falsch Erklärende hat ein zusätzliches Problem.
Und wenn der Adressat sie an eine zuständige Behörde weiterleitet?Falsche eidesstattliche Versicherungen sind nur dann strafbar, wenn sie gegenüber einer zuständigen Behörde abgegeben wurden, vgl. § 156 StGB.
Und wenn der Adressat sie an eine zuständige Behörde weiterleitet?
Und wenn der Adressat sie an eine zuständige Behörde weiterleitet?
Wenn ich mich richtig erinnere, dann brauchte ich bei meinem Missbrauchsfall damals
a) die Anzeige bei der Polizei (war im Ausland), und
b) die eidesstattliche Versicherung auf Deutsch, abgegeben und unterschrieben auf einem Formular des Kartenanbieters
Mit diesen Auflagen wäre mir Betrug nicht im Traum eingefallen, bekam dann den Schaden auch schnell & unbürokratisch erstattet.
[FONT="]Ben (LeoVegas) [/FONT] [FONT="]14. Juli, 20:22 CEST [/FONT] Hallo Timo, vielen Dank, dass sie uns im Leo Vegas Kundenservice kontaktiert haben und entschuldigen sie bitte die verspätete Antwort. Die von Ihnen genannten nicht autorisierten Beträge haben wir Ihnen natürlich schon zurücküberwiesen und entschuldigen uns für die Unannehmlichkeiten. Sie müssen allerdings aus Sicherheitsgründen ihr Passwort ändern bevor wir das Konto wieder aktivieren können um die Kontosicherheit gewährleisten zu können. kommen Sie dazu in unseren Live Chat und wir helfen Ihnen weiter. Bei weiteren Fragen, steht Ihnen unser Kundendienst via Chat, E-Mail und am Telefon zur Verfügung. Unsere gebührenfreie Hotline: Deutschland +49 800 505 2700 Sie erreichen uns täglich von 08:00 Uhr bis 02:00 Uhr. Wir wünschen Ihnen noch einen angenehmen Tag. Mit freundlichen Grüßen, Ben Kundendienst LeoVegas |