Third-party contractor exposure puts GGPoker player data at risk, but passwords were not affected

An unauthorized party accessed player data from GGPoker through a third-party contractor used by the operator. The exposed set included email addresses, dates of birth, balances, and loyalty levels, while passwords were not compromised.

1. The incident centered on a third-party contractor, not GGPoker’s core systems. For PSPs and operators, that distinction matters because vendor access is often where the clean internal perimeter ends and the messy real world begins.
2. The data at risk included email addresses, dates of birth, balances, and loyalty levels. That is enough to create account-targeting, support impersonation, and profile-building issues, even without password exposure.
3. Passwords were not affected, according to the source. That limits the immediate authentication risk, but it does not make the data set harmless for fraud teams or customer operations.