Casinos Austria Data Breach: 150,000 Customers at Risk After Cyber Attack

A massive security incident has shaken the gambling industry in Austria, putting thousands of players on high alert. In early November 2026, unknown perpetrators gained access to the IT infrastructure of an external service provider responsible for operating the Casinos Austria online shop. The affected party is INCERT eTourismus GmbH & Co KG, whose servers were exposed for several days. Customers who purchased vouchers for casino visits or catering services must now expect their personal information to appear in criminal forums.

This news comes at a particularly sensitive time, as data protection awareness in online gambling has never been higher. Casinos Austria has already begun notifying affected individuals via email. It is a classic scenario for modern cybercrime: the main company itself was not targeted directly, but rather a link in the supply chain. This highlights the necessity for gambling operators to subject every external partner to rigorous security audits to maintain user trust.

Numbers and facts

The scale of the attack is only gradually becoming clear. According to current findings, the unauthorized access was concentrated between November 2 and November 5, 2026. It was not until November 5 that INCERT technicians managed to finally close the security gap. Estimates suggest that up to 150,000 data sets could be at risk. The stolen information includes first and last names, dates of birth, home addresses, as well as email addresses and phone numbers. Specific order data and voucher codes may also have fallen into the hands of the hackers.

However, there is an important piece of good news for those worried about their bank accounts. Since the Casinos Austria online shop generally does not store credit card or bank details, these could not be accessed. Nevertheless, the damage is significant, as the combination of names, addresses, and concrete order data is perfect for so-called spear-phishing. In such cases, fraudsters create messages referring to real past purchases to trick victims into revealing further passwords or making payments.

Background

IT service provider INCERT eTourismus reacted immediately upon discovering the incident. In addition to closing the loophole, all access credentials were exchanged, and enhanced monitoring of the systems was implemented. Legal consequences are already being felt, as the Austrian Data Protection Authority has been officially informed. Casinos Austria emphasizes that they are working closely with investigators to fully clarify the incident. A company spokesperson urgently warned against opening dubious attachments in emails.

"The company emphasizes that it will never request passwords or credit card data via email, SMS, or telephone, nor will it demand payments in this manner." - Casinos Austria, press statement on the security incident

Such incidents show that data security is often only as strong as the weakest link in the chain. For the Casinos Austria Group, which enjoys a particularly reputable status as a state-licensed provider, this incident is a massive test of customer confidence.

Why it matters for German players

German customers who occasionally play in Austria or purchase vouchers for casinos there online should exercise caution. Anyone who has used the Casinos Austria shop should check their emails carefully. In Germany, requirements under the State Treaty on Gambling 2021 (GlüStV 2021) are extremely strict. German players are protected by the supervision of the Joint Gambling Authority of the States (GGL) and the central LUGAS system, which monitors the cross-provider deposit limit of 1,000 euros per month. Such an incident at a German GGL-licensed provider would immediately trigger an audit by the authority in Halle. German players should always ensure they only play at providers on the official whitelist, as technical standards for data protection (ISO certifications) are regularly monitored there. While similar EU data protection rules apply in Austria, the breach via a service provider shows that residual risks exist even in the regulated market.

What it means for GGL-licensed casinos

German casinos with a GGL license must learn from this incident. The connection to LUGAS and the OASIS blocking system already requires the highest level of IT security. Should a service provider of a German online casino be attacked, the operator is obliged to report this immediately to the GGL and the responsible data protection officer. For players in Germany, regulation means they have clear points of contact and legal recourse in the event of data misuse. The stake limits of 1 euro per spin on virtual slots also minimize financial risk in the event of account hacking, though they do not protect against identity theft.