Scottish Council Website Hijacked by Offshore Casino Links

Reports show that 16 links on the Scottish Borders council’s directory, which should have pointed users to council websites and contacts, were hijacked and led visitors to gambling sites operating outside UK law.

Read more AFL

According to the BBC, most of the affected sites had once been hosted on a platform called Online Borders, which was shut down eight years ago. Councils were told to create their own websites, but the old links remained active.

Those expired domains were then used to channel visitors to a single gambling portal advertising “top noGamstop casinos.” 

The links stayed on the Scottish Borders Council website until earlier this month, when officials were alerted by the BBC. Following that, the council removed the faulty links and issued a memo urging community councils to ensure their websites were current and properly maintained.

Cyber security specialist Dr Daniel Thomas from the University of Strathclyde described the case to the BBC as “domain squatting,” where expired domains are bought up and repurposed, often by automated systems. 

He explained that community council sites were attractive targets because their URLs still appeared on the official council directory, giving them legitimacy. “When someone is looking for the community council and are met with this gambling portal they will think something is wrong and of course not engage with the site,” he said.

“But when someone is searching for these sites, the now re-directed community council site will be at the top of list, as it appears a local group is giving out suggestions on the best offshore gambling sites to use.”

Read more AFL

Not the first time

This is not the first council or government body to see its online presence hijacked by gambling content. In June 2026, Old Catton Parish Council in Norfolk discovered its website had been compromised.

Hackers replaced the contact page with Indonesian text promoting slot machine games, while the homepage carried an image of a woman playing slots. The council quickly blocked public access by triggering server errors and restored the affected pages, stressing that no staff had uploaded or approved the material.

That same month, more than 100 government and public‑sector websites in India were hit by a similar breach. 

Cybercriminals used server‑side cloaking to push gambling keywords into Google’s crawler while secretly redirecting mobile users to offshore betting apps. Victims included central ministries, police portals, a High Court, and academic repositories.

A year earlier, in June 2025, Nigeria’s National Population Commission faced its own incident. An expired security certificate left a public health tracking subpage vulnerable, and hackers exploited it to redirect visitors to an Australian casino platform.

Read more Coinsilium Raises Predictive Labs Stake as Nijinn Moves Toward Public Launch