What the 2023 Casino Hacks Taught Network Teams

In September 2023 two of the largest casino companies in the world disclosed serious cyberattacks within days of each other. At MGM Resorts, the effects were visible to anyone on the Strip: reports described slot machines out of service, hotel key cards failing, and long queues at check-in. The company later estimated the financial hit at around $100 million. Caesars Entertainment disclosed a breach of customer data, and it was widely reported to have paid a ransom to the attackers.

It began with a phone call

Public reports attribute the attacks to a group known as Scattered Spider, working with a ransomware operation. The group's signature technique is social engineering, particularly calling an IT help desk and impersonating an employee in order to reset their credentials. The firewalls and intrusion systems were beside the point at that stage, because the attackers logged in with what looked like valid access.

Lesson one: the help desk is part of the perimeter

Password and multi-factor resets are among the most sensitive actions any company performs. Yet many firms still rely on easily researched details such as an employee ID or a birth date to verify a caller. Stronger options include a video check, a manager's approval or a hardware security key that cannot be phished. It is cheap to fix compared with an outage.

Lesson two: segmentation decides the blast radius

A resort is really dozens of businesses sharing one network: gaming floors, hotels, restaurants, shops, payroll and guest Wi-Fi. When something goes wrong in one, the question is how far it can spread. Network segmentation limits how far an intruder can move sideways, and it should be tested, not merely drawn on a diagram. Cloud identity systems deserve equal care, since one over-privileged administrator account can cut across every segment at once.

Lesson three: know how you would run without IT

A casino has a useful habit here. Regulated gaming operations already have written procedures for working when systems fail, and some properties reportedly fell back to manual payouts during these incidents. Most businesses have no such plan. Teams should ask what they would do if the directory, the phones and the email all went dark at once, and then rehearse the answer, including how staff will talk to one another.

Lesson four: small devices count

Casinos have also supplied the industry's favourite IoT cautionary tale. Security firm Darktrace once reported a case in which attackers got into a casino's network through an internet-connected thermometer in a lobby fish tank. Whatever the details, the point stands. Every sensor, camera and building control unit is a computer on a network, and it belongs on a segment of its own, as we explain in our guide to casino floor networks.

Beyond the Strip

None of this is specific to gaming. Hospitals, airlines and retailers have since been hit by similar methods. What made the casino cases so instructive was their visibility: when a slot machine goes dark in front of a customer, nobody can pretend that a cyber incident is an abstract IT matter.