Casinos Austria has reported a data security incident involving one of its external service providers, potentially exposing the personal information of around 150,000 webshop customers. The company said the attackers reached customer data through the provider's systems between 2 and 5 November 2026, and it has warned those affected to watch for phishing messages and identity fraud.

The incident was first reported by Austrian broadcaster ORF on 7 November 2026. Casinos Austria subsequently emailed the customers it believes may be affected, telling them it had reason to believe that data from its online shop had been taken. The company stressed that bank and payment card information was not affected, because those details are not stored in the system concerned.

What happened between 2 and 5 November

According to ORF's reporting, unknown attackers gained unauthorised access to the systems of an external service provider used by Casinos Austria. The provider operates technology supporting the company's webshop, through which customers can buy casino vouchers to print or send as gifts. The attackers are reported to have reached the provider's environment and obtained information linked to the online shop during the four-day window.

Casinos Austria spokesperson Patrick Minar confirmed to ORF that the security vulnerability had been closed. He told the broadcaster that bank and card data were definitely not affected because they are not stored in the relevant system. The company has also notified Austria's data protection authority, and cybersecurity specialists are investigating the incident.

What remains unknown is how many individual records were actually accessed, how much information was extracted, and whether the attackers still hold copies of it. The identity of the attackers has not been established, and there is no public evidence linking the incident to a particular ransomware group or financially motivated criminal gang.

What data may have been exposed

The information that may have been exposed is limited to details held in connection with the webshop. According to the reports, the categories involved are customers' first and last names, email addresses, order details and voucher codes. Payment information is not among them.

That distinction matters, but it does not make the incident harmless. Names combined with genuine email addresses, order histories and voucher codes give criminals convincing material for targeted fraud. Casinos Austria has warned specifically that the exposed information could be used for phishing and identity fraud, including fraudulent orders placed in customers' names.

Customers who used the webshop should therefore treat unexpected messages with extra care. A message that quotes a real order or a real voucher code will look far more convincing than ordinary spam, which is why the company has urged customers to verify unexpected emails through its official channels rather than clicking links or opening attachments in messages they did not expect.

Why a supplier breach can hit 150,000 customers

This incident is a reminder that an organisation's security depends on its suppliers as well as on its own systems. Casinos Austria's own infrastructure was not reported to have been directly compromised. Instead, the attackers reached customer data through an external provider that handles part of the webshop operation, showing how a single vendor weakness can expose a large customer base.

Third-party providers routinely handle online shops, customer records, order processing and marketing for large organisations. Every such connection is another route into customer data, and it needs the same scrutiny as an organisation's internal systems: limited access, regular security checks, monitoring of vendor activity and clear incident-response duties in the contract.

What customers should do now

Anyone who has used the Casinos Austria webshop should be cautious about unexpected emails, especially any mentioning orders, deliveries, voucher expiry or refunds. Customers should not click suspicious links, open unexpected attachments, or share passwords, verification codes or payment details in response to unsolicited messages.

They should also watch for unusual orders or account activity, use different passwords for different services, and switch on multi-factor authentication where it is available. Customers who receive a message claiming to be from Casinos Austria and are unsure about it should check it through the company's official website or customer service channels before acting on it.

The investigation continues, and the final picture will depend on what the forensic work establishes about which records were accessed and whether the information has been misused. For now, the confirmed facts are the scale of the potential exposure, the dates of the intrusion, the categories of data involved, and the absence of payment data from the affected system.