Camelot Group

Profile narrative

Camelot Group, trading as the National Lottery, is the organisation that operates the United Kingdom’s National Lottery under a licence granted by the UK Gambling Commission. Its core business consists of selling lottery tickets through a nationwide network of retail outlets and through an online platform that includes a website and mobile application. Players can purchase tickets for a range of draw‑based games such as Lotto, EuroMillions and Set‑for‑Life, as well as instant‑win scratchcards and online instant games. The operator also manages the scheduling and execution of the televised draws, the distribution of prize funds and the allocation of a proportion of revenue to charitable good causes. The online service allows account holders to store payment details, view ticket histories and receive notifications about results and promotions. According to disclosures related to security incidents, the National Lottery’s online portal had a multi‑million user base at the time of the 2018 breach. Retail transactions continue to be supported by thousands of authorised agents ranging from convenience stores to supermarkets. The organisation’s market position is defined by its exclusive right to run the national lottery, which distinguishes it from private gambling operators. Its services are marketed primarily to UK residents, although certain online games are accessible to players who meet age and residency requirements. The combination of physical retail presence and digital channels gives the National Lottery a broad reach across different consumer segments. Revenue generated from ticket sales funds both prize payouts and contributions to community projects, arts, sport and heritage initiatives.

The scale of the operation is reflected in the volume of accounts and the frequency of draws, with multiple weekly draws and daily instant‑game offerings. Security incidents disclosed in public sources show that the operator has faced credential‑stuffing attacks, a distributed denial‑of‑service event and subsequent account‑reset advisories. In November 2016, approximately 26,500 online accounts were compromised through credential stuffing, prompting the operator to block suspicious login attempts, notify affected users and report the breach to regulators. In September 2017, a DDoS attack disrupted the website and mobile app for about ninety minutes, preventing online ticket purchases while retail sales remained unaffected. In March 2018, a credential‑stuffing incident led to suspicious activity on roughly 150 accounts, with fewer than ten showing unauthorised actions, and the operator advised all 10.5 million account holders to change passwords. Throughout these events the organisation emphasized that its core systems remained secure, no financial losses occurred and critical functions such as the scheduled draws continued without interruption. Responses included suspending compromised accounts, directly contacting users to facilitate secure reactivation and reinforcing messaging about password reuse across services. The operator’s handling of the incidents involved cooperation with data‑protection authorities and public communication to maintain trust. These episodes highlight the organisation’s focus on monitoring anomalous login patterns, implementing rate‑limiting measures and maintaining incident‑response procedures. Despite the challenges, the National Lottery continues to operate as the sole licensed provider of the UK’s national lottery, balancing extensive public outreach with ongoing efforts to strengthen its cybersecurity posture. Its role as a regulator‑overseen operator also entails compliance with reporting obligations and contributions to the national good‑cause fund. The combination of a large user base, a dual‑channel distribution model and a statutory mandate shapes the organisation’s distinctive position within the UK gambling and charitable sectors.

Incidents

3 incidents linked to this organisation.