The online poker industry is grappling with a major security breach that's raising uncomfortable questions about how long operators knew about a suspected cheating operation before going public. New reports suggest poker sites were alerted to suspicious activity linked to an account dubbed "Paul Gregg" well before the wider scandal emerged. It forced uncomfortable conversations about transparency and accountability.

How the Attack Worked

This wasn't your typical account fraud. The suspected cheater deployed malware through compromised third-party poker software, specifically targeting high-stakes players' computers. Two tools came under fire: Jurojin Poker and IntuitiveTables, both widely used by serious grinders managing multiple tables simultaneously.

The malicious code leveraged MeshCentral, a legitimate remote-access system, to give attackers a window into players' screens during live hands. Once installed between June 2025 and January 2026, the software basically handed over a player's hole cards to someone sat at home watching everything unfold. Cybersecurity researcher WolfSec0x0 identified between 10 and 30 affected computers across multiple regions. This wasn't a blanket attack. It was highly selective.

The Warning Signs Nobody Acted On

Poker coach Patrick Howard flagged unusual patterns with the Paul Gregg account back in September when he sent his analysis directly to GGPoker. He didn't accuse anyone outright, but the red flags were clear enough for GGPoker to launch their own investigation. Meanwhile, CoinPoker had already noticed something was off. They deleted the account, seized over $100,000 in funds, and reimbursed affected players. The account had been active for less than a week before they cottoned on.

What's particularly telling is that CoinPoker ambassador Patrick Leonard confirmed a larger player group had been complaining about this identity to multiple operators for years before anyone took decisive action. Years.

The Real Damage

Spanish professional Ignacio Moron lost somewhere between $100,000 and $200,000 to this account, with $60,000 of that disappearing in a single 15-minute stretch. That's not just a bad beat. That's a career-changing hit for most players.

The incident has drawn inevitable comparisons to previous catastrophes that nearly destroyed player trust in online poker. The Potriper scandal at Absolute Poker and Russ Hamilton's cheating scheme at Ultimate Bet both involved access to hidden cards, and both left scars on the industry that took years to heal.

Industry Response

Some operators are tightening their belts. ACR Poker has already implemented a feature blocking screen-sharing and screen-capture software from displaying poker tables, a sensible defensive measure. But the broader question remains unsettled: why did it take this long to coordinate a proper response, and what exactly did operators know before going public?

That's the conversation the industry needs to have now. Player confidence depends on it.