GGPoker Security Lapse Exposes Users’ Real Names

GGPoker, the international online poker site that counts Daniel Negreanu among its high-profile brand ambassadors, recently suffered a security breach. For a period of a day or two, customers’ real names were exposed for anyone running the poker client to see.

Software Update to Blame

On the morning of Friday, June 12, GGPoker was down for maintenance, and then when users opened the software, they had to wait for an upgrade to download and install. Upon experiencing the new software features, many were left unimpressed. Complaints started rolling in about annoying dealer voices, missing tournaments in the lobby, problems logging in, and other typical gripes that you might expect from a new software version.

However, included within the changes was new functionality that was a bit more serious than the other issues customers faced. Within each user’s profile on GGPoker was a clickable link on their screenname. Anyone following this link was brought to an outside page, hosted by WSOP, that displayed the player’s real name and GGPoker screenname!

NSUS is the parent company of GGPoker, and it also owns the World Series of Poker brand. Perhaps this misstep by GGPoker is a consequence of some ill-conceived business synergy between the two entities.

Not All Players’ Identities Compromised?

Making this situation more confusing is the fact that there have been reports of some individuals whose real names were not visible on their WSOP profiles. A few people speculated therefore that only those who had given their consent for their WSOP profiles to be linked to their real identities were affected by this new development. GGPoker requires players in certain high-stakes cash games and tournament final tables to reveal their real names as a security measure, and so the idea was that these new profiles on the WSOP site were simply a collection of these individuals whose real names were public knowledge anyway.

This theory was quickly blown out of the water as multiple users reported on various poker forums that they had randomly checked the profiles of other customers. The vast majority the user base at GGPoker seems to have had their real personal data revealed to anyone who looked at their profiles.

This issue affected the global .com player pool. It also appears to have been replicated in ring-fenced local markets, like Ontario. It is perhaps in these smaller markets that the most problems could arise.

Some players are concerned about the possibility of cyber-stalking whereby an upset or irrational opponent could start harassing them in various online venues. Now that many players’ identities have been exposed, there’s the possibility that angry poker losers may be able to track down those against whom they hold a grudge and attempt to harm them physically. As bad as this may be among the global player pool at large, it’s much more concerning in smaller areas with ring-fenced player liquidity as many opponents might live within a short geographic distance of each other and thus be easier to track down.

GGPoker Quick to Fix

Given the potential backlash that could ensue from such a mistake as doxxing thousands of users, it’s understandable to GGPoker was quick in fixing it. Within about two days from the time the issue was initially reported, it had been corrected.

The remedies were applied in stages. For a while, even after the links to players’ WSOP profiles were removed from the GGPoker client, real names could still be found by Google searching screenames on the WSOP.com domain and vice versa. Only later was this info scrubbed from the WSOP profiles.

Even though this security hole is no longer present, the entire incident has left a bad taste in the mouths of many customers. Who knows how many accounts’ identifying info was saved for later use by malefactors?

GGPoker Breaking Laws and Own Policies

It’s almost unquestionable that GGPoker’s actions have violated the provisions of privacy laws around the world. The European GDPR springs to mind as the obvious example.

Furthermore, GGPoker violated its own Privacy Policy, which coincidentally was last updated on June 12: the same day that the software upgrade in question was deployed. A part of this policy reads, “In Section 2 above, We have set out, in a table format, a description of how we will use your Personal Data and the lawful basis we rely on to do so.”

Looking at this Section 2, we see that there are three distinct purposes listed for how a person’s name is used:

• Customer account creation, customer support/reply to any communications, and provision of services. We may need to share your Personal Data with the Group in order to provide you with our services
• to publish your details publically on Our platforms if You win an event, or when such events are broadcasted.
• Relevant communications about marketing products and/or bonuses, retargeting of current customers’ e-mail in furtherance of the above. This includes sharing Personal Data with the Group and Meta (Ireland). The above depends on how the customer requests to be contacted (E-mail, SMS, or Social Media). Personalisation services within the website

Publishing customers’ real names on WSOP.com does not fit into any of these categories by any stretch of the imagination.

Community Reactions

Reactions from people in the online poker community are almost entirely negative. See a few examples of them below:

Scandal-Prone GG

This isn’t the first time that serious scandals have plagued GGPoker.

In December 2023, it came to light that GGPoker user “Moneytaker69” had been exploiting a client-side weakness in the poker software to effectively cheat. He was able to see his all-in equity at any point during a hand, which enabled him to make nearly perfect decisions at the tables. “Moneytaker69” was eventually banned and his confiscated account balance redistributed to players, but many felt that this sum represented only a fraction of that player’s ill-gotten gains.

Perhaps GGPoker’s anti-cheating stance would be taken more seriously were it not for the room’s periodic “Olive Branch Initiatives” of which there have been three from August 2020 through October 2025. During specifically designated periods of time, people who have been banned from the site can submit applications to have their bans overturned.

In October 2022, GGPoker was found by the U.K. Gambling Commission to be deficient in its anti-money laundering and social responsibility obligations. The company had to pay a fine of £672,829 ($750,000). In this case, we do understand that it might not have been entirely GGPoker’s fault; the UKGC is known to be an especially harsh and punitive gaming licensing authority.

Astonishingly, GGPoker has inadvertently revealed players’ real names before. In January 2023, cyber-security researchers confirmed that the poker client was sending users real names in plain text over the internet while communicating without encryption with the server on GGPoker’s end.

Looking for a New Poker Home?

If this incident and others like it have put you off GGPoker for good, then it’s about time you found yourself a new online poker home. We believe that BetOnline offers a compelling product that not only includes a poker room but also a sportsbook and casino as well. With your first deposit, you’ll qualify for a 100% up to $1,000 bonus. Click the button to get started:

For additional information on BetOnline, head over to this comprehensive BOL review. For another alternative to GGPoker, take a look at this ACRPoker review. If you reside in the United States, then you cannot sign up for GGPoker anyway, but you can check out this offshore poker USA guide to get a better understanding of the poker rooms open to you.

June 18, 2026 – by Max Golden, Editor-in-Chief