1Win 2024 Data Breach
Platform · Online betting and gambling services · Digital gaming and wagering platform · Global
1Win Online Betting Platform Breach (2024): 96 Million User Records Including Passport Numbers Exposed
Online betting and gaming platform.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
96.5MRecords
2024Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
Gov IDPassport Number
Breach Summary
1Win, an international online sports betting and casino platform, suffered a data breach in early November 2024 after a threat actor using the handle "fe0dor" exploited a server misconfiguration to access the platform's production systems. The attacker published a 29-gigabyte archive on the Exploit.in underground forum containing more than 450 million database rows. Researchers estimated those rows represented approximately 96 million unique user accounts, placing it among the largest recorded breaches in the gambling industry. The attacker initially demanded $1 million in ransom, later escalating that demand to $15 million before negotiations collapsed. 1Win's founder confirmed the breach publicly via Telegram and stated that infrastructure had since been secured. The exposed data included full names, email addresses, phone numbers, dates of birth, geographic locations, IP addresses, passport numbers, and password hashes. Those passwords were stored using SHA-256 without salting, a weak implementation that dramatically reduces the time needed to crack them through brute force. Security researcher Troy Hunt verified the dataset's authenticity in February 2025 and added it to Have I Been Pwned, notifying nearly 96 million affected email addresses. The combination of passport data, location history, and crackable passwords creates serious risk of identity theft, account takeover, and financial fraud. Because 1Win serves gamblers, the exposed data could also be used to target individuals with coercive scams or to exploit problem-gambling behavior. 1Win made no formal breach notifications to affected individuals in most jurisdictions where it operates. Because the platform serves European Union users, it is subject to the General Data Protection Regulation, and regulators in the United Kingdom and Germany opened scoping inquiries following the incident. Affected individuals should treat their 1Win password as compromised, change it immediately on any other account where it was reused, and monitor financial accounts and identity documents for signs of misuse.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
96.5M records analyzed
About 1Win
1Win is an international online sports betting and casino platform operating under a Curaçao gaming license and incorporated in Cyprus. The platform accepts users across Europe, the Commonwealth of Independent States, Asia, and other markets, offering sports wagering, casino games, and live dealer products. 1Win is one of several large offshore betting operators serving markets where domestic regulation of online gambling is limited or absent.
Why They Hold Your Data
Online betting platforms collect highly sensitive account data, payment records, wagering history, device metadata, and bonus or affiliate activity across digital gambling services.
Recent Developments
1Win has maintained aggressive marketing activity across its target markets, including influencer sponsorships and digital advertising. The company operates in a regulatory gray zone in many jurisdictions, which limits formal oversight of its security and notification practices. The November 2024 breach was the defining event of the recent period.
Data Points Exposed
7 verified field types
Date of Birth High
Email Address
Geographic location
IP Address
Passport Number Critical
Password High
Phone Number
Breach Impact
In November 2024 a hacker operating under the alias fe0dor published a 29GB archive containing data from 1Win's production servers on the Exploit.in forum, exposing approximately 96 million user accounts. The exposed data included names, email addresses, phone numbers, dates of birth, geographic locations, IP addresses, passport numbers, and SHA-256 password hashes stored without salting. The attackers initially demanded $1 million in ransom, which escalated to $15 million before negotiations collapsed. 1Win's founder confirmed the breach via Telegram the same evening it was published, acknowledged the extortion attempt, and stated that infrastructure was subsequently secured. Forced password resets were initiated for active accounts. Because 1Win operates under a Curaçao license while serving European Union users, GDPR obligations apply. Regulators in the United Kingdom and Germany opened scoping inquiries. 1Win made no formal breach notifications to affected individuals in most jurisdictions where it operates.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
An intimate-data breach: preferences, orientation or explicit content linked to an identity create acute coercion and blackmail exposure. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
F
Threat Actor: fe0dorConfidence: Low
Motivation: Unknown
A low-confidence alias with insufficient reliable public sourcing for a standalone profile. It may be a forum seller, handle, or one-off alias tied to a specific claim.
Protect Yourself
Protect Yourself: Limited Disclosure
Check If You’re Affected: Verification Required
Because being associated with this breach can itself be harmful, we do not confirm whether anyone appears in it to unverified parties. Verify your identity to privately check whether your own data appears in this breach or related indexes.
We will only reveal whether a specific person appears in this breach to that person.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation