Whether via physical venues or online platforms, casinos pull in millions of players and billions of dollars a year, with the industry estimated to grow by $11.42 billion between 2021 and 2025. With players trusting casinos with their funds and their high-value personal data, it’s no surprise that threat actors are looking to monetize attacks on these organizations. And with the industry’s technology changing rapidly, hackers are provided with more opportunities to target systems via mobile payments, online games, third-party suppliers, and IoT devices.
A ransomware warning to casinos
An FBI Cyber Division notification issued in November 2021 warned of an alarming uptick in attacks against tribal casinos, which have increased by 1,000% since 2019. The alert also identified that several notorious ransomware groups like REvil, Ryuk, Bitpaymer, Conti, Cuba, and Snatch have all conducted successful attacks on casinos, shutting down systems and demanding ransoms in return or seeking out sensitive customer data to sell on the dark web.
Six Oklahoma tribal casinos belonging to the Cheyenne and Arapaho tribes were shut down and computer systems were crippled by ransomware in July 2021. Only a month later the Ho-Chunk casino in Wisconsin Dells was hit, forcing the casino to shut down for four days, followed by the Tesuque Casino in New Mexico in September 2021, halting operations for three days. These breaches have left organizations unable to operate until system restoration has taken place, causing significant financial and reputational damage.
An ecosystem of services
Online casino customers need to be confident that the login process and, crucially, the process of depositing and withdrawing their funds are smooth. There are multiple payment platforms and gateways that online casinos use to handle customer data, from PayPal and Skrill through to traditional card-based transactions (e.g. Visa and Mastercard). But relying on these third-party solutions to access, hold, and process customer data can put casinos at a higher risk of being breached by malicious actors. 51% of businesses have suffered a data breach caused by a third party, so casinos need to ensure that their data is protected throughout its lifecycle.
The Internet of Things
Casinos use the Internet of Things (IoT) to help automate and streamline their customers’ experience through wearable device gaming, smart lighting and cameras in venues, motion detectors, consumption tracking technology, trackable casino chips, and remote check-in/out. But many of these devices can be targeted by hackers who are looking to infiltrate the casinos’ systems, as was the case for a North American casino in 2017. In this attack, cyber criminals managed to infiltrate the casino’s network by exploiting a vulnerability in the smart thermometer of an IoT-connected fish tank. Once inside, they were able to access a database of customers and pull this data up into the cloud.
Account Takeover Fraud
Online gambling services are also heavily targeted by Account Takeover (ATO) fraud, which is when malicious actors target personal information in order to withdraw remaining funds or unique loyalty benefits from the victim’s account. Research shows that 52% of companies in the gambling industry have seen a notable increase in ATO activity, with nearly half of these companies claiming that each ATO consumed up to 5 hours in support time. Beyond the direct costs, compensation fees, and hours of recovery time, ATO can damage brands permanently by destroying the trust and loyalty of customers and increasing consumer friction.
Identify, Notify, and Shield
Within casinos’ systems, all cybersecurity solutions should provide a superior level of protection against incoming threats, without diverting time from critical business activities or impacting customer experience. By using over 3,500 cyber threat intelligence feeds to threat hunt on your behalf and shield ‘all risk’ threats automatically, CleanINTERNET offers proactive, simple cyber threat intelligence for casino businesses. The service shields automotive organizations from 99% of globally mapped cyber threats in real-time, saving millions of dollars on separate threat feeds and saving your internal security team time on threat hunting. As well as protecting against threats like ransomware and ATO, CleanINTERNET helps your business comply with the relevant security standards to create a Zero Trust environment. This way, your customer data, your third-party partners’ data, and your reputation are reliably protected.
Get in touch to speak to the Centripetal team about mitigating critical cyber threats in casinos and see how CleanINTERNET employs ThreatOps to shield against the growing threat of ransomware in our latest downloadable eBook.
