The British Columbia Lottery Corporation (BCLC) is advising all PlayNow users to change their passwords after a “credential stuffing” incident saw thousands of dollars in player funds stolen.
A BCLC advisory said players across three provinces had passwords stolen from other companies’ sites. “Credential stuffing” is a cybercrime attempt in which fraudsters attempt to access player accounts using email addresses and passwords that were previously exposed or stolen from other companies, based on the notion that people often use the same user ID and password across multiple websites. PlayNow detected the fraud after noticing a suspiciously high volume of traffic on the site.
As well as B.C., BCLC operates PlayNow in Saskatchewan and Manitoba in partnership with the Saskatchewan Indian Gaming Authority and Manitoba Liquor & Lotteries.
Matt Lee, senior communications specialist at BCLC, told that while BCLC couldn’t provide specific numbers due to security purposes, the incident affected “less than 1% of our PlayNow player base in British Columbia, Saskatchewan and Manitoba, with the majority of users impacted in B.C.”
Approximately $4,000 in player funds appear to have been fraudulently withdrawn. Lee said BCLC is working with those players affected to deposit an equal dollar amount into their PlayNow account, plus two years of credit monitoring services at no charge.
