Superuser Scandal Rocks Poker World: Suspect Paul Gregg Identified

The online poker community is currently facing one of its most significant security breaches in recent years. A player registered under the name Paul Gregg has been identified as the primary suspect in a sophisticated superuser scandal. Unlike traditional server hacks, this breach exploited vulnerabilities in popular third-party table management software, specifically IntuitiveTables and Jurojin. By gaining remote access to the computers of high-stakes professionals, the attacker was able to see their opponents' cards in real-time, gaining a near-insurmountable advantage.

The scale of the cheating is substantial, affecting between 10 and 30 of the world's most prominent high-stakes players. While the poker sites themselves remained secure, the compromise of auxiliary tools created a back door for the fraud. CoinPoker was the first to take decisive action, banning the account and redistributing seized funds. However, the slow reaction of other major networks has sparked a heated debate regarding the efficiency of security teams and the safety of using approved third-party software.

Numbers and facts

The data surrounding the Paul Gregg account is statistically anomalous. At CoinPoker, the security team identified impossible win rates in less than a week. This led to the immediate ban of the account under the alias Europe and the confiscation of $100,000. Spanish professional Ignacio Moron revealed he lost nearly $200,000 to this account across various sites, including a staggering $60,000 loss in under an hour. Fortunately, CoinPoker refunded $60,000 to him in April 2024.

Analysis submitted by Patrick Howard to GGPoker in early September further detailed the extent of the suspected cheating. Over a sample of 32,780 hands, the Gregg account maintained a win rate of 13.9 bb/100 and a 75.6% win rate on river showdowns. Similarly, on the WPN network, an account named pgs showed a 32.73 bb/100 win rate over 25,705 hands. Other suspected aliases, such as OcOO and JackKlompus, displayed near-perfect river play, further cementing suspicions of foul play.

Background

This scandal underscores a growing threat in the digital poker landscape. The use of third-party tools for multi-tabling and statistical tracking has become standard for professionals, yet these very tools provided the entry point for the hacker. By exploiting these programs, the suspect could capture screens without alerting the poker client's internal security systems. A statement from the investigation emphasizes the disparity in response times:

"CoinPoker's security team was able to identify impossible win rates in less than a week. The account was banned, and $100,000 was confiscated and redistributed to the impacted players." - CoinPoker Security Update

In response to these targeted attacks, ACR (Americas Cardroom) boss Phil Nagy announced the implementation of Screen Shield, a new security feature designed to detect and block screen-sharing or capture software. Additionally, suspicious hand histories are being audited by GTO Wizard to identify machine-assisted play. The case serves as a wake-up call for the industry to reconsider the safety of allowing third-party software to interface with active game clients.

Why it matters for German players

For players in Germany, this scandal highlights the vital importance of playing on platforms regulated by the GGL (Gemeinsame Glücksspielbehörde der Länder). Under the GlüStV 2021, licensed operators must adhere to rigorous IT security standards and are subject to constant monitoring through the LUGAS system. This includes strict limits on deposits (usually 1,000 Euro per month) and Einsatzlimits for slots. More importantly, German-licensed sites are required to ensure the integrity of their software environment, which often means prohibiting or strictly auditing the use of third-party tools that could lead to such superuser vulnerabilities. Engaging with unlicensed offshore sites leaves German players without the legal protection and oversight provided by the GGL whitelist.

What it means for GGL-licensed casinos

Casinos and poker rooms with a GGL license must prove that their games are fair and their platforms secure against external manipulation. A superuser exploit lasting for over two years, as seen in the Gregg case, would be highly unlikely under the German regulatory framework. The GGL mandates regular audits of random number generators and the exclusion of any software that could facilitate unfair advantages. Furthermore, the German regulatory system provides a clear path for recourse if a player suspects fraud, something that is often lacking in the unregulated high-stakes environment where Paul Gregg operated. Players are strongly advised to check the official whitelist before depositing funds.