A former NHS-created health app website displayed promotions for offshore online casinos claiming to operate outside GAMSTOP on September 4, 2026. The incident has raised concerns about how unlicensed operators reach consumers in Great Britain.

The website for My Therappy, a stroke-app review platform created by the former Northern Devon Healthcare NHS Trust, appeared to have been taken over by casino affiliate pages. No person or organisation has been identified as responsible.

Royal Devon investigates the domain

Royal Devon University Healthcare NHS Foundation Trust succeeded Northern Devon Healthcare NHS Trust. Its digital and cyber-security teams are examining the domain and its status.

“We take matters relating to online safety and security seriously and are looking into this as a priority,” the trust said in a statement reported by SBC News.

The original website was created more than a decade ago as a review platform for stroke patients. Reports by SBC News and iGaming Expert said visitors were instead directed to pages promoting non-UK casinos and services described as being outside GAMSTOP.

Why the wording matters

GAMSTOP blocks registered consumers from using gambling websites operated by companies licensed in Great Britain. It does not cover unlicensed offshore operators. A licence issued in another jurisdiction does not permit a company to offer gambling to consumers in Great Britain.

The Gambling Commission has identified affiliate pages using phrases such as “not on GAMSTOP” as a route into the illegal market. Its research says search engines are a main pathway for self-excluded consumers seeking gambling websites that are not registered with the scheme.

The Commission’s 2024 methodology found that affiliate pages can target people seeking to avoid:

  • Identity checks.
  • Operator restrictions.
  • Self-exclusion controls.

Users of unlicensed websites may not receive the protections required in the regulated market. Those protections include the safeguards imposed on operators licensed in Great Britain.

Search abuse creates a trust problem

A compromised established domain can give gambling pages access to an existing website history, recognised branding and potential search-engine authority. That may make the pages appear more credible than a newly created casino affiliate site.

The suspected My Therappy incident follows reports of similar casino promotions appearing on public-sector and community websites. These cases raise separate questions about:

  • Abandoned domains.
  • Outdated content-management systems.
  • Search platforms’ ability to detect manipulated pages.

For consumers in Great Britain, the practical check is whether the gambling business appears on the Gambling Commission’s public register. Marketing language about being outside GAMSTOP is not evidence of authorisation. It may indicate that an operator is deliberately avoiding a core player-protection system.

What happens next

Royal Devon has not announced a final finding about the website. It has also not confirmed whether the domain was hacked, transferred or otherwise compromised.

The cyber-security investigation will need to establish:

  • Who controlled the pages.
  • How long the casino content was available.
  • Whether visitors faced further risks.

The Gambling Commission can disrupt operators that offer gambling to consumers in Great Britain without a licence. The case also puts pressure on domain owners, hosting companies, search engines and affiliate networks to respond when trusted websites are used to promote illegal gambling.

The suspected incident shows how a trusted web address can become a gateway to unlicensed gambling, even when the operator itself is not associated with the original site owner.