Tabcorp fined $350,000 after customer accounts hacked
Australian gambling operator Tabcorp has been fined $350,000 after failing to implement mandatory account security measures, leaving customers vulnerable to unauthorised withdrawals totalling hundreds of thousands of dollars.
The Victorian Gambling and Casino Control Commission (VGCCC) found that Tabcorp breached four technical standards between January 30 and June 23, 2025, by failing to fully introduce multi-factor authentication (MFA) across its wagering platform.
VGCCC Chairperson Chris O’Neill said the bookmaker had failed to meet the standards expected of Victoria’s wagering and betting licence holder.
“We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause,” O’Neill said.
The breaches allowed some customers to continue accessing their TAB accounts without additional identity verification, despite the security requirements forming part of Tabcorp’s Victorian wagering licence.
According to the regulator’s disciplinary decision, Tabcorp first warned the VGCCC in July 2024 that technical difficulties would prevent it from implementing MFA before its new 20-year wagering licence commenced in August.
The regulator subsequently granted several extensions, allowing Tabcorp until January 29, 2025, to complete the upgrades, but the bookmaker requested another extension after identifying technical defects during testing.
The VGCCC rejected that request on February 6, 2025, declaring Tabcorp’s wagering system unapproved until MFA was fully implemented and requiring weekly progress reports.
Despite that decision, the Australian gambling operator did not complete implementation until June 24, when customers using older versions of the TAB app were required to upgrade.
During the implementation period, Tabcorp reported multiple incidents involving unauthorised access to customer accounts.
In January 2025, the company informed the regulator that a malicious actor had accessed at least 195 customer accounts and withdrawn $308,098.91.
Most of those incidents occurred while regulatory extensions were still in place, although 14 customers were affected during the subsequent period of non-compliance.
A further incident in May involved an automated attack targeting dormant accounts without MFA protection.
Tabcorp told the regulator that the attacker had attempted to access accounts using login credentials believed to have originated from the dark web.
Approximately $31,000 was withdrawn from customer accounts nationally, including $13,471 belonging to Victorian customers.
The incidents occurred despite Tabcorp reporting that 99% of its customers had adopted MFA by April 1, 2025.
The remaining customers continued to face security risks because older versions of the TAB app could still be used without the additional authentication requirements.
All affected customers were subsequently reimbursed, either by Tabcorp or their financial institutions.
In its response to the disciplinary proceedings, Tabcorp disputed the regulator’s interpretation of the technical standards.
The company argued that MFA was not expressly required under several of the relevant provisions and that alternative security controls were sufficient.
It also maintained that any non-compliance ended in March 2025, when MFA became available to customers.
However, the VGCCC rejected those arguments, finding that making MFA available was insufficient when customers could continue accessing accounts without using it.
The regulator described Tabcorp’s interpretation of its obligations as unduly narrow and expressed concern that the company had failed to acknowledge its non-compliance.
The commission determined that the breaches warranted a financial penalty rather than a formal warning, citing the length of the non-compliance, actual customer losses and Tabcorp’s previous regulatory record.
However, it classified the contraventions as being towards the lower end of seriousness, acknowledging the technical complexity of implementing MFA and the company’s efforts to reimburse affected customers.
The $350,000 fine represents approximately 3.5% of the maximum $9.88 million penalty available under Victorian legislation.
The regulator also considered Tabcorp’s previous disciplinary history, including a $4.6 million fine imposed in August 2024 for repeated responsible gambling failures and a $1 million penalty in September 2023 for failing to comply with regulatory directions.
O’Neill said the latest penalty was intended to reinforce the importance of protecting customer accounts across Victoria’s regulated wagering industry.
“Customer-protection requirements are necessary to safeguard Victorian customers and maintain confidence in regulated wagering products and services. This penalty reinforces to all gambling providers that they must fully implement and maintain those protections,” she said.
Tabcorp operates the TAB wagering brand across Australia and holds Victoria’s exclusive wagering and betting licence, which commenced in August 2024 for a 20-year term.
