NHS-Linked Healthtech Site Hijacked to Promote Non-GAMSTOP Casinos

^{Screenshots taken on 4 September 2026 show My Therappy's homepage overtaken by promotions for offshore, non-GAMSTOP casinos. (Photo: Casinos.com)}

An NHS-linked healthtech website has been hijacked to promote offshore casinos that operate outside GAMSTOP, the UK's self-exclusion scheme, in the latest case of illegal gambling adverts appearing on public sector web domains.

My Therappy, an app-review site originally developed by Northern Devon Healthcare NHS Trust to help stroke patients find rehabilitation apps, was still displaying the takeover as of 4 September 2026. Casinos.com's own check of the live site confirmed its homepage now carries the title 'Non UK Casinos 2026 - Best Foreign Casino Sites' and features content promoting operators that sit outside UK licensing and GAMSTOP, credited to an author named 'Daniel Reeves', a byline that also appears on unrelated offshore-casino promotional content elsewhere online.

NHS Trust Investigating the Domain

The My Therappy site was originally built by Northern Devon Healthcare NHS Trust in 2013 as the first app-review resource for stroke patients, and responsibility for it later passed to the Royal Devon University Healthcare NHS Foundation Trust. Its official social media accounts have not posted since 2021, suggesting the domain had been left largely unmaintained before being taken over.

'We have raised this with our digital and cyber security teams for investigation. We are currently establishing the status of the website domain and will provide a further update once we have completed our enquiries. We take matters relating to online safety and security seriously and are looking into this as a priority,' the Royal Devon University Healthcare NHS Foundation Trust said in a statement supplied to Digital Health News, which first reported the takeover.

Part of a Wider Pattern of Hijacked Public Sites

The incident follows similar takeovers of UK public sector web pages in recent months. Two weeks earlier, gambling adverts appeared on 16 of 69 community council listings hosted on the Scottish Borders Council's website after an outdated backlog system was exploited. In June, the Old Catton Parish Council's site was found displaying an advert for an Indonesian online slots operator.

Each case has involved unlicensed operators exploiting neglected or outdated public sector web pages to reach UK consumers, including people who have self-excluded from gambling through GAMSTOP.

Regulators Under Pressure to Act on the Black Market

The pattern adds to pressure on the Gambling Commission, the Department for Digital, Culture, Media and Sport and the newly formed Illegal Gambling Taskforce to curb unlicensed operators targeting UK players. The regulator has previously said it has a robust strategy to combat unlicensed gambling and has committed reserve funding to tackle black market betting to improve its data tools.

UK regulators have separately pursued individuals for running unlicensed gambling operations in the past year, underlining a wider enforcement push that has yet to stop domain hijacks of this kind recurring on neglected public sector sites.

GAMSTOP, the free national self-exclusion scheme covering all UK-licensed operators, cannot restrict access to sites based overseas, which is why regulators and licensed operators alike continue to flag offshore promotions as a route around it. The NHS Trust has not yet confirmed a timeline for restoring the My Therappy domain to its original purpose.