Casinos Austria breach: data on about 150,000 webshop customers taken through an external service provider
Attackers took data on about 150,000 Casinos Austria webshop customers via a service provider. The company says bank and card data were not affected.
What happened
Casinos Austria, the Austrian casino group, says unknown attackers reached its online shop through the systems of an external service provider between November 2 and 5, 2026 and took data on about 150,000 webshop customers. The incident was reported on November 7 by ORF, Austria’s public broadcaster, and the company emailed the affected customers itself. A company spokesperson, Patrick Minar, told ORF that the security gap behind the access has been closed. Austria’s data protection authority has been informed and security specialists are investigating. Exactly which data sets were taken is still being established, and who carried out the attack is not known. The company’s own warning to customers, quoted in the Austrian press, is that the data could be used for targeted phishing attempts or for identity fraud such as orders placed in other people’s names.
Who is affected
The affected group is the customers of the Casinos Austria webshop — about 150,000 people. The information that may be involved, on the reporting so far, is first and last names, email addresses, orders and voucher codes; the investigation into the exact records is still running, so that list may change. One point the company states definitively: bank and credit card data were not affected, because the webshop system does not store them — its spokesperson used the word “definitively” to ORF on that point. No passwords were reported among the data taken. Customers were notified directly by email, and the company warned them not to click links or attachments in unexpected messages and never to disclose passwords or card details in reply.
How serious
The concrete risk is targeted phishing and voucher theft, not direct theft from bank accounts. A name and email address joined to a real order history and voucher codes lets a scammer write as Casinos Austria about a real purchase — a voucher that “failed to arrive,” a refund that needs “confirming,” an order with a problem — and quote details a generic fake could not. Voucher codes also have value in themselves if they were among the data taken: a valid code can be redeemed by whoever holds it. The company’s second warning, identity fraud in the form of orders placed in a victim’s name, follows from the same combination of name, email and buying history. What this data does not do on its own is open the customer’s accounts or charge their cards: no passwords and no payment data were in the system that was reached, so the danger arrives as a convincing message or a misused voucher, not as a drained account.
What to do now
If you have bought from the Casinos Austria webshop, treat messages about orders, vouchers or refunds as untrusted even when they quote your real name and a real purchase: do not click links or open attachments in them, and never enter a password or card details from such a message. Go to the official shop yourself, in your browser or the app you already use, and check your orders and voucher balances there; a voucher code you are saving is worth checking and, where the shop allows it, using or securing sooner rather than later. Watch for order confirmations or deliveries in your name that you did not place, and dispute them with the company at once if any appear. Because your email address is the channel scammers will use, make sure that email account itself is protected with a strong, unique password and two-factor authentication — it is the reset key for almost everything else.
Sources: Die Presse (APA), “Cyberangriff auf Casinos Austria: Daten von 150.000 Kunden gestohlen,” November 7, 2026 · Das Land, “Hackerangriff auf Casinos Austria: Daten von 150.000 Kunden betroffen,” November 8, 2026 (reporting ORF Wien and APA)