1win 1win.com 1win data breach: what happened and what to do
In November 2024 the betting platform 1win suffered a breach affecting 96,166,543 accounts. Exposed: email and IP addresses, phone numbers, dates of birth, locations and SHA-256 password hashes.
View all 13,115 breaches- Breach date
- 2 Nov 2024
- Affected
- 96,166,543
- Data exposed
- Dates of birth, Email addresses, Geographic locations, IP addresses, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
1win is an online betting platform. In November 2024 its user data leaked, and Have I Been Pwned (HIBP) later counted 96,166,543 affected accounts, which makes it one of the larger gambling-related breaches on record. HIBP dates the breach to 2 November 2024 and added it on 3 February 2025.
What happened
HIBP says the platform suffered a data breach that exposed 96M users. News coverage from November 2024 reported that the data was being offered for sale and, according to those reports, that portions were then leaked after an extortion attempt. Those details come from secondary coverage rather than a 1win statement, so treat the specifics of the demand as reported, not confirmed. One news report quoted an approximate figure of 100 million users.
HIBP received the data from a source who asked to be credited as "Leidhall".
What was exposed
HIBP lists dates of birth, email addresses, geographic locations, IP addresses, passwords and phone numbers. The passwords are SHA-256 hashes. A hash is a scrambled version of a password. SHA-256 is fast to compute, which is a weakness for password storage: attackers can test huge numbers of guesses quickly, so short or common passwords can be recovered from hashes like these.
That's why a password from this breach can't be considered safe just because it was hashed. If yours was simple, assume it's known.
What that lets criminals do
Passwords and emails together are the classic ingredients for credential stuffing, where criminals try the same pair on banks, email, shops and other betting sites. Reused passwords are the entry point. One cracked 1win password can open any other account that shares it.
Dates of birth are hard to change and are asked for as a verification question by banks, carriers and government services. Combined with a name and phone number, they help with identity theft and account takeover calls.
Gambling context raises the stakes. Being in this dataset says something about you, and scammers know it. Expect fake "bonus" or "account verification" messages that name the platform, and extortion emails that threaten to reveal your gambling activity. Those emails are almost always bluffs, but they're upsetting.
The company's response
HIBP's entry doesn't quote a company statement. The news coverage listed below tells the story from the reports that exist.
How to check
Search your email address on HIBP. If you're in it, change the password on 1win if the account still exists, and on every site where you used the same one.
Where to start
Start with the password. If you had a 1win account, change that password first, then any other account that used the same one. After that, turn on two-factor authentication on your email, because email is the account that resets everything else. The rest of the steps below take a few minutes each.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you had a 1win account, set a new password there. Then change any other account that used the same password, starting with email, banking and shopping. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, bank and main social accounts. A stolen password alone then isn't enough to get in.
- 3
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 4
Ignore extortion emails
If someone emails saying they'll expose your betting history unless you pay, don't pay and don't reply. Report it to your email provider. The senders rely on being in a leak like this one, not on knowing anything specific about you.
- 5
Watch for identity theft signs
Your date of birth is in the data. Consider a credit freeze at Equifax, Experian and TransUnion if you're in the US, and keep an eye on statements and credit reports.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the 1win breach?
Search your email address on Have I Been Pwned. It lists 96,166,543 accounts for this breach.
What was exposed?
Dates of birth, email addresses, geographic locations, IP addresses, passwords (as SHA-256 hashes) and phone numbers.
Should I change my password?
Yes, on 1win and anywhere you reused it. SHA-256 hashes can be cracked when the password is simple.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
