On Friday 5 September 2025, Luxembourg’s Loterie Nationale (National Lottery) reported its IT systems had recently been affected by a “security incident”.
The Loterie Nationale announced that the incident affected the IT systems of one of the National Lottery’s subcontractors, responsible for the operation and maintenance of the sports betting platform loteriesport.lu and may have enabled unauthorised access to certain personal data of players, despite the security and protection measures in place to guarantee the confidentiality and integrity of this information.
In accordance with its obligations under the General Data Protection Regulation (GDPR), the National Lottery announced it had informed all individuals who may have been affected by the incident and had also notified the National Commission for Data Protection (Commission Nationale pour la Protection des Données - CNPD).
According to the Loterie Nationale, based on the investigations carried out so far, the potentially affected personal data includes identification details (e.g. surname, first name, username), contact details (e.g. address, telephone number), banking information and records of transactions carried out by players during a given period.
The Loterie Nationale stressed that no information concerning passwords or payment cards had been affected by the incident and the circumstances in no way impacted the gaming platform loterie.lu or the personal data recorded there.
Moreover, the Loterie Nationale announced the deployment of urgent corrective measures and said it is working closely with the subcontractor concerned to guarantee the implementation of the necessary protection, remediation and mitigation measures and will inform its customers of any further developments regarding the incident.
The loteriesport.lu platform remains operational and accessible to players for the time being.
