S:P: Large Amounts of Personal Data Leaked from UB - Poker News Headlines

sluggger5x · 12-02-2011, 07:09 PM

Quote:

A large amount of personal data about UB players has been leaked. The data, which was posted publicly on the internet, appears to contain information about every player with an account at Ultimate Bet.Subject: Poker estimates that roughly 3.5 million accounts are affected. Accounts on UB’s sister site, Absolute Poker, are not included.

Quote:

A link to the data was posted on the Two Plus Two Poker Forums by an anonymous poster who removed the link eight minutes later. This is the only such public posting that we know of, but in that brief time period, enough people saw the link that it is currently being passed around privately.

BrookTrout · 12-02-2011, 07:38 PM

The leaked data includes the following:

Full names
Screen names
E-mail addresses
Phone numbers
Mailing addresses
Account balances
IP addresses
Deposit methods used (e.g. “echeck”)
Birth dates
Account numbers (unique identifiers for UB accounts, not bank accounts numbers)
VIP status
Affiliate status
Blacklist status

------

I think thats more thn enough info to create some havoc. Any confirmation? Can only find one source that claims 2+2 as its source...

noImagination · 12-09-2011, 09:30 PM

UB responds to data leak:

Quote:

Originally Posted by UB

Hello Mark,

Thank you for making contact.

We are aware of the recently reported Cereus database leak, and we are investigating it. We want to assure you that we take this breach seriously, and we remain committed to the highest level of integrity in dealing with our players and to the protection of their privacy.

Our immediate concern was to determine that the published information did not compromise our players' personal banking or credit card details, and we can confirm that it has not, nor does it include social security numbers.

This investigation is a top priority for us, and our examination of all the facts will be both methodical and comprehensive. Our review of the published files is ongoing, though we believe them to be an out-of date version of our current database. If our inquiry confirms that an actual theft of UB and Absolute Poker data has occurred, we will do everything possible to bring the criminals to justice.

We are taking all available precautionary measures to ensure the safety of your account. Your patience in this matter is appreciated while we work to uncover further details.

Regards,

UB Support
Support@UB.net

link

**SGT RJ** · 12-13-2011, 10:12 PM

Updates: To the best of my knowledge, the information has been removed from the online sites that were hosting it.

Personal information in the form of DOB, address, phone number, and account ID# and name were included. Information such as account passwords, banking information, and social security number WERE NOT included.

UB is reportedly aware of the situation and looking into how the leak occurred.

Requests for links to the data will not be allowed in this thread, nor should anyone who had (or still has) access to the information post it here.

ChaosReigns · 12-14-2011, 04:20 PM

Would someone who registered for an acount, but did not deposit money, be considered to have an account and affected by this?

**SGT RJ** · 12-14-2011, 04:53 PM

I think if you registered in the effected time frame, then it's a possibility, yes.

The good news is that the information they would have gotten is generally public domain information - it's major use would seem to be contacting people to try to either sell products (poker related, most likely) or to phish for additional personal data.

Standard personal identity protections would probably keep anyone effected pretty safe. Never give out SSN, passwords, or financial information via email, and monitor your CC accounts and credit information from the three major bureaus (if you're from the US).

smooth101 · 12-14-2011, 07:11 PM

Did UB require SSN for a real money account?

**SGT RJ** · 12-14-2011, 09:07 PM

Quote:

Originally Posted by smooth101

Did UB require SSN for a real money account?

I have no idea, but multiple people who saw the data said that SSNs were not part of the leaked data, so if it was required by UB is was stored in some other way (thank goodness).

Wilbury Twist · 12-15-2011, 04:28 AM

Quote:

Originally Posted by smooth101

Did UB require SSN for a real money account?

I don't remember ever having to give an SSN for any poker site, UB or otherwise. Bear in mind, it wouldn't always be an SSN, so long as a site offers business to non-Americans.

**Bobo Fett** · 12-15-2011, 07:46 AM

Just to confirm what I found in the file:

Quote:

Originally Posted by Bobo Fett

As for the info released, this is what mine looks like:

First Name
Last Name
Canada
Email Address
IP Address
Street Address
7-digit number (Corresponds to nothing I recognize; I would assume it's a UB account #)
Screen Name
DOB
City
Province
Postal Code
24/11/2008 23:49
ULTIMATEBET
100000
54
Phone Number
266.8
0
24/11/2008 23:49
UltimateBet.Com
266.8
Bronze VIP
0
11
299
Male
94020
25:06.3
20/10/2006 0:00
Affiliate
15/11/2009 0:00
British Columbia
Canada
N
KY
0
0
0
33:01.1

Unfortunately, there doesn't appear to be any column headings to make things easy to identify.

No sign of anything like a SIN (Canadian version of SSN) or banking info. Basically, name, address, phone number, email address, DOB, IP address, and some UB account info. No password.

My best guess at the dates would be that 2006 was account creation, 2008 would be last time I played, and 2009 the last time I logged in. But I'm just guessing.

I didn't keep the file, so don't PM me for your information. Even if I had wanted to keep it, it would have died in my hard drive meltdown last week.

smooth101 · 12-15-2011, 04:36 PM

Quote:

Originally Posted by SGT RJ

I have no idea, but multiple people who saw the data said that SSNs were not part of the leaked data, so if it was required by UB is was stored in some other way (thank goodness).

Quote:

Originally Posted by Wilbury Twist

I don't remember ever having to give an SSN for any poker site, UB or otherwise. Bear in mind, it wouldn't always be an SSN, so long as a site offers business to non-Americans.

Okay thank you. Yeah, I knew it was not in the file but I did not know if UB had that data.

thadarkman78 · 12-15-2011, 09:01 PM

Quote:

Originally Posted by Wilbury Twist

I don't remember ever having to give an SSN for any poker site, UB or otherwise. Bear in mind, it wouldn't always be an SSN, so long as a site offers business to non-Americans.

Granted I never played on UB, but if they used echecks you are required to use your SSN. Since banking info appears to not have been leaked I imagine that it was indeed not leaked then.

Chuck504 · 12-16-2011, 02:08 PM

Anyone know how/why UB did this?

Wilbury Twist · 12-16-2011, 06:03 PM

Quote:

Originally Posted by Chuck504

Anyone know how/why UB did this?

I can't speak for the "how" but if you'd like an educated guess of the "why," check out Haley Hintze's blogs on Dec. 4, Dec. 8 and Dec. 16. The short answer is data trafficking. As she wrote in one entry, "if you’re a Euro who once played at UltimateBet and you start receiving spams for Titan Poker, Poker Europa or Mansion Poker (just to name a few), it’s probably a result of this stuff."

I won't post links to these blog posts, as I'm sure doing so violates some spamming rules of this forum. But if you're the type who is interested enough to follow this story, you probably know where to look.

Mookman5 · 12-25-2011, 11:50 PM

Well it had been a few months since I logged in on 2+2. Shortly after the UB Data leak, Travis Makar sent me this email. Thought I would share b/c it seems these data lists were pretty common.

Quote:

It's funny how everyone is talking about legal issues on 2+2 regarding this new list of UB customers that was stolen, everyone wants to see the list but the ones that have it including 2+2 are afraid to release it for fear of being sued for privacy issues, but wanted me to spill my guts and kept telling me "who would sue you it’s ok no will sue".

Its my guess a former employee had taken it to get back at them for being laid off or wanted paid not to release more names and information. So many sites had holes in them that lower end employee's could access this kind of information. When I was at UBT lists came in all the time. There were even affiliates at UB who would use their own stolen list to mass mail with their affiliate codes added in so that they would get their cut, it was not uncommon to see a list range from a hundred thousand accounts to a million and a half.

There was so much lying and cheating going on not just at UB/AP but other sites, I do not see how they could ever legalize this in the states. I remember a list of well over 200 fixes and patches that had to be done and most had been considered low priority.

Think about it if Microsoft had a bug or a security leak which happened often then your personal data, emails, passwords could make your poker software vulnerable too.