Casino Security Breach
You've seen enough Hollywood blockbusters about casino heists to know that gambling institutions are constantly in the crosshairs of attackers—online and off. In the digital realm, however, better malware tools and access to deep funding make today's cyber criminals more than a bad movie, especially when lucrative payloads are for the taking.
Aug 05, 2020 The Hard Rock Casino has been hit by a series of casino breaches, marking a worrisome trend among data breach victims: most targets have suffered one or more similar compromises in the recent past. This pattern of repeated breaches is especially true of retailers and banks, and increasingly—casinos and gaming enterprises.
The Hard Rock Casino has been hit by a series of casino breaches, marking a worrisome trend among data breach victims: most targets have suffered one or more similar compromises in the recent past. This pattern of repeated breaches is especially true of retailers and banks, and increasingly—casinos and gaming enterprises.
Casinos might be looking at system events and errors instead of application events and game transaction logs that might indicate a breach. Systems also might not analyze things like security events. They’re not necessarily picking up on things like multiple failed logins or brute-force type password attempts. Jul 30, 2009 Roy Ramm, on behalf of LCI, has signed an Undertaking after the Information Commissioner’s Office (ICO) found LCI in breach of the Data Protection Act. LCI will ensure portable devices, including laptops, that are used to store personal information, are encrypted. The Hard Rock Casino has been hit by a series of casino breaches, marking a worrisome trend among data breach victims: most targets have suffered one or more similar compromises in the recent past. This pattern of repeated breaches is especially true of retailers and banks, and increasingly—casinos and gaming enterprises. Feb 20, 2020 U.S. Casino operator MGM Resorts said on Thursday it was the victim of a data breach last year. The report comes after the company earlier claimed that details of over 10.6 million hotel guests had.
In May 2015, attackers were able to steal cardholder names, credit card numbers, and CVV codes belonging to hotel guests and customers. In 2016 they suffered similar incidents due to malware being installed on POS systems, allowing attackers to steal customers' credit card information.
Investigators hired by the casino discovered unauthorized POS network access and the presence of malware, leading to this statement issued on June 27, 2016 regarding the second data breach due to malware. However, this time the attack was more widespread than the year before, targeting the resort itself—as opposed to restaurants and retail locations within the hotel. And like other recent attacks, PoS scraping malware was used to steal customer data as it entered the resort’s payment card system.
In 2017 still more customer data was exposed through a far-reaching breach of the Sabre booking system. While Hard Rock itself was not at fault, they still bore the effects of having their name associated with yet another loss of confidentiality regarding customer data. Eleven hotels were affected.
It may come as no surprise that casinos and gaming firms are ideal cyber attack targets, but how competent are these enterprises when it comes to rudimentary security? Given the volume of privileged financial data collected, you'd expect to see corresponding security measures in place. Let's take a look at some of the top casino/resorts and see if this is the case.
Bellagio: 751
The Italian-themed Las Vegas hotel/resort and casino scores a solid 751 CSTAR rating. Apparently its fortress-like facade is more than just looks—but a few gaps such as lack of HTTP Strict Transport Security and DNSSEC make for a less-than-optimal security posture.
Caesars Palace: 504
Arguably Las Vegas' most well-known hotel/resort, Caesars Palace—despite its towering facade—has left its digital fortress poorly protected. Lack of DNSSEC and server data leakage are a few of its security shortcomings, along with a 53% CEO approval rating, which increases the risk of internal attack.
The Venetian: 561
This five-diamond luxury hotel/casino may not be the only Italian-themed megaresort on the Las Vegas Strip, but unlike its counterpart the Bellagio, the Venetian lacks various website perimeter security controls—sitewide SSL, DMARC, and DNSSEC, to name a few.
Are Online Casinos More Resilient?
Las Vegas Casino Security
Brick-and-mortar gambling establishments are one thing, but what about online casinos born in the cloud? You wouldn't be be blamed for assuming thats casinos are essentially the world's largest banking operations. But unlike banks, casinos resorts are faced with a myriad of risks introduced by on-site retail establishments, service operations, and countless public-facing ATMs and card readers. The Hard Rock Casino may have fallen victim to sophisticated malware and PoS scraping technologies, but if recent history is any indication, proper patching and vulnerability detection could have saved them from a repeat compromise. This is what UpGuard's resilience platform provides: validation that your systems are free from security flaws, vulnerabilities, and misconfigurations that could lead to data breaches and outages.