Black Market Hijacking: Illegal Casinos Take Over Old NHS Websites

The tactics employed by black market gambling affiliates have reached a new level of audacity. In the United Kingdom, affiliates have begun hijacking defunct National Health Service (NHS) websites to promote casinos operating without a valid license. This method is particularly insidious as it exploits public trust: patients seeking health resources are instead met with portals explicitly advertising ways to circumvent state protection mechanisms like the GamStop self-exclusion system.

A prominent victim of this scheme is the site my-therappy.co.uk. Originally established over ten years ago by the Neuro-rehabilitation Team at Northern Devon Healthcare NHS Trust, the domain served as a review platform for apps designed to aid stroke recovery. Today, however, visitors find no medical advice but rather an aggressive list of providers lacking a UK Gambling Commission license. By doing so, the hijackers utilize the domain authority built over years to rank illegal offers high in search engine results.

Numbers and facts

The scale of cyberattacks targeting the British health system is massive. The NHS provides care for approximately 68 million residents through a network of 229 trusts. The fact that old information pages are now being misused for illegal gambling is just the tip of the iceberg. In the past, other high-profile domains have fallen victim to similar hijacking attacks, including a tourist information page for North Devon, a PlayStation news portal, and even a former domain belonging to Nigel Farage's Brexit Party.

The messaging on these hijacked pages is nearly identical, specifically targeting the vulnerabilities of problem gamblers. The former therapy site states:

"There’s a quiet exodus happening. UK players are slipping past GamStop’s grip and into the arms of non-UK casinos, where rules feel more like polite suggestions. There are no limits on deposits, no time-outs unless you want them, and no-nonsense bonuses that don’t vanish mid-spin."

This overt promotion of rule-breaking underscores the significant challenge facing regulators. Entain, one of the largest licensed operators in the UK, has already challenged the UK Intellectual Property Office. The group questions why unlicensed brands are permitted to claim British trademarks, which provides them with a sense of 'commercial legitimacy' despite it being illegal to offer betting in the UK without a Gambling Commission license.

Background

Domain hijacking is an effective method for the black market to bypass marketing filters used by Google or social media platforms. Since NHS or political organization websites are classified as trustworthy, security algorithms are less likely to flag them. Furthermore, the history of the NHS shows it is a recurring target for cybercriminals. In June last year, the Russian group BlackCat hacked the Barts Health NHS Trust. Shortly after, the group INC Ransom published approximately three terabytes of data from NHS Dumfries and Galloway. While hijacking defunct domains for gambling affiliates is less technically complex than ransomware, it is equally devastating for player protection.

Why it matters for German players

For German players, this development serves as a stark warning. Locally, illegal providers from Curacao or Malta frequently attempt to bypass German regulations established by the State Treaty on Gambling 2021 (GlüStV 2021). While casinos licensed in Germany must strictly adhere to a 1,000 Euro monthly deposit limit and a 1 Euro per spin stake limit, black market sites often advertise the circumvention of these very protections.

It is particularly dangerous that such sites could gain visibility in Germany through search engine optimization (SEO) manipulation. Players should therefore always verify if a provider is listed on the official whitelist of the Joint Gambling Authority of the Laender (GGL). Connection to LUGAS (the cross-state gambling supervision system) and OASIS is mandatory in Germany. Playing on sites advertising "No Limit" or "No LUGAS" means entering a legally unprotected environment where winnings are often not paid out and no player protection exists. The recent UK case demonstrates that these actors stop at nothing, not even the manipulation of health portals.

What it means for GGL-licensed casinos

Licensed operators in Germany must prepare for increased competition through such unfair methods. If illegal affiliates begin hijacking German educational or health domains, the battle for top search engine rankings will become even more difficult. The GGL is tasked with consistently implementing IP blocking and payment blocking to fulfill the channeling mandate of the GlüStV 2021. Only a robust legal market can prevent players from falling for such manipulative offers.