Data breaches have become a frequent and widespread phenomenon, affecting various industries and organizations on a global scale.
Even the casino industry, despite its prominence, has not been immune to the escalating threat of data breaches.
The allure of substantial financial transactions, sensitive customer data, and valuable intellectual property renders casinos an attractive target for cybercriminals who seek to exploit weaknesses in their cybersecurity defenses.
This discussion will cover the aspects of casino data breaches, examining the underlying causes, the ensuing repercussions, and the preventive and mitigation measures implemented to address such incidents.
Gaining a comprehensive understanding of the intricacies surrounding casino data breaches is crucial for casino operators and consumers who place their trust in these establishments by providing their personal and financial information.
Table of Contents
December 2023 – Casino Data Breach
Indigo Sky Casino & Resort experienced a data security incident where documents containing personal information were accessed by an unknown third party on December 1, 2023.
The compromised documents included employees’ personal details like names, driver’s license numbers, Social Security numbers, and medical information, as well as some patrons’ names and similar identifying information.
However, no banking or financial information was included in the accessed documents.
In response, Indigo Sky Casino promptly initiated an internal investigation, secured their systems, involved law enforcement, and hired a forensic security firm to assess and ensure the security of their computer systems.
On January 10, 2024, Indigo Sky began mailing notification letters to individuals whose information may have been affected, offering complimentary credit monitoring and identity theft protection services.
November 2023 – Casino Data Breach
On November 2nd, 2023, Rivers Casino Des Plaines announced a data breach that potentially exposed the personal information of customers, employees, and online sportsbook users.
The breach, which occurred on or around August 12th, 2023, involved unauthorized access to the casino’s systems by hackers.
The company has Set up an incident response center for its customers. This center is available from 8:00 AM to 5:30 PM CST, Monday through Friday, by calling (866) 983-3108.
September 2023 – Casino Data Breach
Caesars Entertainment, a self-proclaimed leading casino chain in the United States, is renowned for its expansive loyalty program within the industry.
On 17th September 2023, Caesars became aware that the perpetrators had successfully infiltrated its loyalty program database, which contains a substantial amount of sensitive customer information, including driver’s licenses and social security numbers.
An 8-K form filed by Caesars with the U.S. Securities and Exchange Commission says that the company has roughly paid an amount of $15 million against the $30 million demanded by cyberattackers.
Caesars has stated that it is currently conducting an investigation into the data that was obtained by an unauthorized individual.
As of now, there is no evidence to suggest that any passwords/PINs, bank account details, or payment card information belonging to any members have been accessed.
11th September 2023: MGM Resorts International has officially announced that it is currently addressing a cybersecurity issue that has had an impact on several of its IT systems.
This includes its primary website, online reservation services, as well as in-casino related systems such as ATMs, and credit card machines.
Some users on the Facebook group have expressed their concerns regarding the malfunctioning of slot machines and difficulties encountered while attempting to access hotel accommodations at the resorts operated by the company.
The company promptly initiated an investigation after the identification of this cybersecurity concern. In order to safeguard our systems and data, decisive measures were expeditiously implemented, including the temporary shutdown of specific systems.
November 2022 – Casino Data Breach
The Crystal Bay Casino is a diminutive gambling establishment situated in Lake Tahoe, catering to both the local populace and tourists. The casino provides its patrons with access to slot machines and various forms of entertainment, while also broadcasting sporting events.
Regrettably, the unassuming casino recently fell victim to a cyber attack that potentially jeopardized the safety of its players.
The company’s investigation has concluded that certain files might have been copied from the database on or around November 27, 2022.
The breach at Crystal Bay Casino had a significant impact on multiple documents, affecting a considerable number of individuals. Precisely 86,291 individuals were duly notified about the breach, as they were all exposed to potential risks stemming from it.
It is imperative for anyone who has received such notification to promptly undertake necessary measures to ensure their personal protection.
In the event of receiving a notice, it is highly advisable to contemplate implementing a credit freeze as a precautionary measure against fraudulent activities.
February 2014 – Casino Data Breach
The IT and networking systems of the Sands Hotel and Casino were infiltrated by Iranian hackers. Despite the absence of any discernible financial incentive, the cyberattackers managed to gain access to extensive employee data and effectively immobilized the company’s systems.
The repercussions of this attack were substantial, as it resulted in the complete destruction of seventy-five percent of the company’s servers located in Las Vegas.
Cybersecurity experts within the organization estimate that the expenses incurred solely for equipment replacement and data retrieval exceeded $40 million.
They also left personal messages for Adelson, “Encouraging the use of Weapons of Mass Destruction, UNDER ANY CONDITION, is a Crime, signed, the Anti WMD Team,” said one. “Damn A, Don’t let your tongue cut your throat,” warned another.
Casinos protect their customers through physical security (trained personnel, cameras, etc.), cybersecurity (encryption, firewalls, etc.), and responsible gambling practices (age verification, self-exclusion programs, etc.).
