Flutter Hack Impacts Up to 800,000 Paddy Power and Betfair Users

_{Photo credit: Piotr Swat / Shutterstock.com}

Dublin‑based Flutter Entertainment has confirmed a “serious data incident” affecting up to 800,000 customers of its Irish and UK betting brands Paddy Power and Betfair. There is no indication that its other brands, including FanDuel in the US and Sportsbet in Australia, have been impacted. 

Flutter had earlier detected that an unauthorized third party had accessed “limited betting account information”, including usernames, email addresses, IP addresses, device IDs, and, in some instances, names and parts of customers’ physical addresses. The firm stressed that no passwords, ID documents, or usable payment details had been breached.

Given Flutter’s monthly active base of roughly 4.2 million users in the UK and Ireland, the breach impacted nearly one in five customers.

Flutter has engaged external cybersecurity specialists and launched a full investigation, confirming that the incident has been resolved and access has been contained. The company also notified Ireland’s Data Protection Commission and the UK’s Information Commissioner’s Office.

Security experts warned the exposed data could be used in convincing spear‑phishing campaigns, particularly among users who spent large amounts of money on the platforms. Flutter advised affected customers to remain vigilant, though it said “there is nothing you need to do in response”.

Chief marketing officer at Storm Guidance, Harley Morlet, told the BBC,

With the advent of AI, I think it would actually be very easy to build out a large-scale automated attack. Basically, focusing on crafting messages that look appealing to those gamblers.

The public is advised to exercise caution, particularly with regard to emails that might encourage users to click links or enter card details.