Unauthorised access at one of GGPoker's third-party service providers may have exposed players' email addresses, dates of birth, balances and loyalty levels, the room told players on 13 November 2026. Its notice says there is no indication that passwords, real names, ID documents or card details were compromised.
GGPoker says it learned of the access on 5 November and has reported it to data protection and gambling regulators and to law enforcement. It says it has no indication that its platform was compromised or that any player funds were accessed or affected.
The bigger risk is a convincing fake message rather than a lost password. GGPoker's own notice warns that the details may be used to make fraudulent emails, texts and calls look genuine. A scammer who knew your nickname, balance and loyalty level would sound a lot like support.
From GGPoker's notice: the room “will never ask you for your password, full card details or security codes” by email, text or phone.
What Information Was Involved in the GGPoker Data Breach
The notice lists the data under its own heading, “What information was involved”, and describes two items as “limited”. Everything in the table below comes from the notice, grouped by type.
| Category | May be involved | Not compromised, per GGPoker |
|---|---|---|
| Identity | Email address, nickname, date of birth, gender, country | Real name, physical address |
| Account | Status (active, suspended, closed, excluded), KYC completed yes or no | Password, ID documents |
| Money | Balance, limited deposit and withdrawal information | Banking and credit card information |
| Play | Limited game statistics: buy-in, rake, payout | None listed |
| Rewards | Rank, level, bonuses earned, marketing consent | None listed |
| Device | Device type, operating system type | None listed |
VIP-Grinders is a GGPoker affiliate partner.
The KYC entry is a yes or no flag showing whether verification was completed. The ID documents themselves sit in the other column. The balance and the deposit and withdrawal entries describe money in the account, not access to it.
How GGPoker Has Responded
Beyond the reports to regulators and law enforcement, the notice lists the steps GGPoker took: it secured the affected access points, restricted the provider's access and opened an investigation. It says it is also reviewing its arrangements with the supplier and strengthening its own security.
Some players say they have not received the email. Anyone unsure whether their account is included can ask GGPoker support.
Not yet public: which provider was involved, how many players are affected, which GGPoker sites they play on and when the access began.
The investigation is still running. GGPoker says it is monitoring the situation and taking steps to limit the risk of further disclosure or misuse of the information.
Is This Linked to the Mesh Agent Attack?
Nothing in the notice connects the two. Mesh Agent was a remote-access agent planted on players' own Windows PCs through two compromised poker tools. The researcher who exposed it put the number hit at 10 to 30 players, mainly high-stakes regulars.
This incident sits on a GGPoker supplier's system and involves account and loyalty data, not live screens. Anyone still worried about the remote-access attack on high-stakes players can run the five read-only PC checks the researcher published.
Supplier breaches have hit gambling before. Crypto betting site Shuffle said in October 2025 that a breach at its customer-management provider, Fast Track, hit most of its users, and PokerStars' US operator told the Maine Attorney General that 110,291 people were affected by the 2023 MOVEit file-transfer attack.
Why Your Balance & Loyalty Level Matter to a Scammer
None of these fields is a login on its own. Together, they could let a stranger write a message that sounds like GGPoker support.
| What they may know | What a fake message could say | The tell |
|---|---|---|
| Nickname and email | Greets you by your GGPoker nickname | A nickname is no proof it is GGPoker |
| Balance and deposit or withdrawal details | A withdrawal is “on hold” pending checks | A link to sort it outside the client |
| Rank and bonuses | Rewards are about to expire | A login page reached from the message |
| KYC status | Verification is incomplete | A request to upload documents from a link |
| Date of birth and country | A “security” call that reads your details back | Any request for a password, full card details or a code |
By GGPoker's own rule, a message asking for a password, full card details or a security code is not from GGPoker, however much else it knows about you. Open the client or contact support yourself instead of replying.
One of the account statuses on the list is “excluded”. Anyone who has self-excluded should treat unexpected gambling offers with the same caution, and free support is available from Gambling Therapy, an online service run by the UK charity Gordon Moody.
Five Steps to Protect Your GGPoker Account
The first four come from GGPoker itself, in this notice and in its security post of 15 October 2026. The fifth covers the email account a fake message would be sent to.
- Turn on two-factor authentication for your GGPoker account.
- Set the Fund password and a passkey on your GGPoker account.
- Change your GGPoker password if you use it anywhere else, and keep it unique to GGPoker.
- Do not click links in a message you are unsure about; contact help@ggpoker.eu directly instead.
- Secure the email account the notice went to, starting with its own password and two-factor authentication.
The room made the same Fund password and passkey request in the security update GGPoker posted in October. Neither appears in the data the notice lists, so each adds a check a scammer could not pass with it.
Your Data Rights & Who to Contact
The notice gives players three routes, and each handles a different kind of question.
- Account questions and suspicious messages go to GGPoker support at help@ggpoker.eu.
- Requests about your personal data go to the data protection officer at dpo@nsus.mt.
- Complaints go to Malta's Office of the Information and Data Protection Commissioner.
Under Article 15 of the GDPR, a player can ask a company to confirm what personal data it holds on them and to provide a copy. The data protection officer named in the notice is the address for that request.
What Comes Next for GGPoker Players
GGPoker says it will provide further updates where appropriate as its investigation progresses. It also says it will keep cooperating with the regulators and law enforcement authorities it has notified.
Until then, the five steps above cover what a player can control. For GGPoker's next update, follow online poker news as the story develops.
FAQs
Was GGPoker hacked?
GGPoker says the unauthorised access came through a system run by one of its third-party service providers. Its notice says there is no indication that the GGPoker gaming platform itself was compromised.
Were GGPoker passwords leaked in the data breach?
GGPoker says there is no indication that account passwords were compromised. It still recommends that players consider changing their password, especially if they use it elsewhere, and turn on two-factor authentication.
Is my money safe on GGPoker after the breach?
GGPoker says it has no indication that any player funds were accessed or affected. Balances and limited deposit and withdrawal information may be among the data involved, so the two-factor authentication and Fund password settings it recommends are worth turning on.
How do I know if my GGPoker account was affected?
GGPoker has been emailing players whose information may be involved, and players began reporting the notice on 13 November 2026. If you are unsure whether a message is genuine, go to GGPoker support directly rather than using any link in it.
What should I do with a suspicious GGPoker email?
Do not click any link in it or reply with any details. Contact help@ggpoker.eu directly, as the notice itself advises.
