1Win, an international online sports betting and casino platform, suffered a data breach in early November 2024 after a threat actor using the handle "fe0dor" exploited a server misconfiguration to access the platform's production systems. The attacker published a 29-gigabyte archive on the Exploit.in underground forum containing more than 450 million database rows. Researchers estimated those rows represented approximately 96 million unique user accounts, placing it among the largest recorded breaches in the gambling industry. The attacker initially demanded $1 million in ransom, later escalating that demand to $15 million before negotiations collapsed. 1Win's founder confirmed the breach publicly via Telegram and stated that infrastructure had since been secured. The exposed data included full names, email addresses, phone numbers, dates of birth, geographic locations, IP addresses, passport numbers, and password hashes. Those passwords were stored using SHA-256 without salting, a weak implementation that dramatically reduces the time needed to crack them through brute force. Security researcher Troy Hunt verified the dataset's authenticity in February 2025 and added it to Have I Been Pwned, notifying nearly 96 million affected email addresses. The combination of passport data, location history, and crackable passwords creates serious risk of identity theft, account takeover, and financial fraud. Because 1Win serves gamblers, the exposed data could also be used to target individuals with coercive scams or to exploit problem-gambling behavior. 1Win made no formal breach notifications to affected individuals in most jurisdictions where it operates. Because the platform serves European Union users, it is subject to the General Data Protection Regulation, and regulators in the United Kingdom and Germany opened scoping inquiries following the incident. Affected individuals should treat their 1Win password as compromised, change it immediately on any other account where it was reused, and monitor financial accounts and identity documents for signs of misuse.

Online betting platforms collect highly sensitive account data, payment records, wagering history, device metadata, and bonus or affiliate activity across digital gambling services.

1Win has maintained aggressive marketing activity across its target markets, including influencer sponsorships and digital advertising. The company operates in a regulatory gray zone in many jurisdictions, which limits formal oversight of its security and notification practices. The November 2024 breach was the defining event of the recent period.