Youth arrested months after cyberattack on B.C. lottery players

A file photo shows the B.C. Lottery Corporations logo outside its Vancouver head office.

Mounties in Richmond say they arrested a youth suspect as part of an investigation into a cyberattack targeting lottery players last summer.

The July 2024 attack impacted user accounts on the B.C. Lottery Corporation’s PlayNow website.

A suspiciously high traffic volume led the BCLC to learn the site was the victim of “credential stuffing,” a practice wherein fraudsters attempt to gain access to user accounts using emails and passwords leaked or stolen from other websites.

Hackers made 250,000 attempts to gain access to a small percentage of PlayNow accounts, according to the BCLC.

“Immediately upon detection, BCLC notified impacted players that their accounts had been locked due to suspicious activity and took measures to block the suspicious traffic,” reads a Wednesday news release from the Richmond RCMP announcing the arrest.

“Based on the initial evidence from the BCLC database and access logs, the unauthorized access to some of the compromised accounts originated from Richmond.”

Thus, the Richmond RCMP’s economic crime unit took conduct of the investigation, and over the next months identified and traced a suspect to a location in the city.

“Investigators believed this suspect was responsible for some of the compromised accounts, and allegedly purchased stolen login information from a social media platform,” police said.

The young person was arrested on Feb. 28. Police say that based on “all situational factors” and consultation with the BCLC, the suspect will undergo a restorative justice program under the Youth Criminal Justice Act.