The U.S. online gaming sector has faced a barrage of ransomware attacks, data theft, and extortion attempts over the last several years.
What appeared initially to be isolated cases is now seen to form a trend impacting all types of operators, regardless of their size.
Gaming businesses store lots of financial information about their clients, loyalty programs, and even internal systems of casinos and hotels. And this data is protected by technologies far more outdated than those in the banking or health care industry.
The situation is better for online Gaming, allowing a typical site to offer a 300 euro reward with no upfront payment, with a moderate risk of bots bypassing KYC systems and account abuse.
Protecting the infrastructure behind these functions requires strong access controls.
Several incidents illustrate how varied and damaging these attacks have become. The table below covers the most significant cases in brief:
In contrast to brick-and-mortar venues, online casinos rely on a combination of account management, payment tools, customer support systems, and data analytics.
The incidents above share a handful of recurring attack methods. Understanding each one helps explain why gaming keep appearing in breach headlines.
Cyberattacks involve the blocking of important systems, as in the case of MGM, Caesars, and several other online services, and the encryption of data, which is hard to recover from.
The groups now engage in stealing information and later threatening to release the data, a tactic that was recently employed in targeting MGM and Caesars in 2023.
Calls from impostor employees are still the most effective means of gaining access. A single call succeeds where other attacks require much greater effort.
Credentials compromised by impersonating company employees to the help desk give attackers direct access to identity platforms like Okta. From there, they can move laterally across linked systems without breaching each one separately.
Caesars was hacked through its IT provider and not through its internal network. Providers are granted wide access privileges, which makes them vulnerable to attack.
Casinos operate a uniquely dense mix of systems which creates several specific weak points. These sites present a wider attack surface than most industries, for a few reasons:
Even a well-secured casino can be compromised through a weaker link in one of these connected systems. Once inside, attackers can exploit any element of the shared infrastructure.
Not all of the stolen data will have equal value on the black market. Generally, the attackers try to steal personal identification information, payment and banking details.
Loyalty card details, which are linked to the customer’s spending behavior and identity, and insider credentials are also their primary targets. These data types often overlap in the database of a single casino.
MGM claimed a $100 million loss on its Q3 2023 financials, whereas Caesars reportedly paid roughly $15 million in ransom. The cost does not include long-term reputational damage and legal fees.
High-profile breaches like MGM’s have historically triggered customer lawsuits over exposed personal data. These add legal costs on top of direct recovery expenses.
These events have pushed many operators to rethink security practices that once seemed adequate. Casinos have several concrete defenses available to prevent a repeat of these incidents:
Few breached casinos had all of these in place at once. Layering them together is what actually closes the gaps attackers look for.
Customers can also take steps to protect their data. A few practical steps help limit the fallout after a breach notification:
These actions cannot reverse the damage, but they reduce the chance of an attack escalating further.
With cyberattacks on casinos continuing to make news, vigilance is the only protection available to customers.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…