{"id":105711,"date":"2025-03-13T12:23:14","date_gmt":"2025-03-13T04:23:14","guid":{"rendered":"https:\/\/version-2.com\/?p=105711"},"modified":"2025-03-13T12:24:42","modified_gmt":"2025-03-13T04:24:42","slug":"on-a-roll-in-vegas-dont-blow-it-keep-your-digital-guard-up","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2025\/03\/on-a-roll-in-vegas-dont-blow-it-keep-your-digital-guard-up\/","title":{"rendered":"On a roll in Vegas? Don\u2019t blow it \u2013 keep your digital guard up"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\u00a0<\/div>

Gamblers and dealers beware; whether in Vegas or Monte Carlo, it\u2019s not strictly your wallet that\u2019s at risk of running on empty.<\/em><\/p>

What do gamblers, casinos, and the FBI have in common? If your answer is money, then try again. The digital age has arrived at brick-and-mortar casinos around the world, bringing with it its own flavor, including malice of a different kind than traditional card counters or chip dumping.<\/p>

It\u2019s true that casinos are highly regulated and well-protected against fraud of many kinds (often resembling or surpassing the security at hospitals and airports), but these days, it\u2019s cybercriminals who have their eyes set on the grand prize. Casinos bank more than just their guests\u2019 stakes. It\u2019s the sensitive data they keep, such as financial records, personal details, and more, that make up the jackpot nowadays.<\/p>

With ESET World 2025<\/a><\/strong> taking place in the city of \u201clost wages\u201d from March 24, 2025<\/strong>, perhaps it\u2019s a good opportunity to raise cyber awareness in an area that might not be so obvious, as, increasingly, it is the data of the city\u2019s guests, rather than the vaults, feed tables, and slot machines, that criminals are interested in.<\/p><\/div>

The table is set<\/h3><\/header>

The city of Las Vegas has many nicknames. Also known as the \u201cgambling capital of the world,\u201d the city is known for its lustrous casinos, luxurious hotels, and, of course, games. Within every casino, virtually hundreds of thousands of US dollars get exchanged daily. In 2023, this accounted for a collective $66.5 billion in casino revenue<\/a>.<\/p>

Not even George Clooney\u2019s Ocean\u2019s Eleven character, Danny Ocean, would scoff at such an amount, but even he would be shocked at the idea that there is more to a casino than the contents of its vaults.<\/p>

Beyond the billions is the valuable data of a casino\u2019s clientele, from people searching for lodging to event organizers, or regular, everyday casino-goers. From an even broader perspective, data on business partners (supply chains that provide the machines and security systems), employees, and even the top managers themselves, would be of great interest.<\/p><\/div>

Place your bets<\/h3><\/header>

Why is all of this so interesting to threat actors? Let\u2019s start with the sensitive data, like personal information. Anyone who\u2019s ever checked in at a hotel knows the sort of details they have to provide to be given their rooms, such as:<\/p>

  1. Some form of an ID (state IDs, drivers\u2019 licenses, passports, etc.)<\/li>
  2. Their name, address, preferences, email<\/li>
  3. Payment details<\/li><\/ol>

    On top of that could be other specifics, such as further personal data (companions, dietary restrictions, accessibility requirements) or more. This much granular data can be very valuable on the black market, with stolen personal data from documents such as IDs or passports<\/a> costing from hundreds to thousands of dollars per document<\/em>.<\/p>

    Thus, threat actors roll the dice. In 2023, it came to light that the prominent casino chain MGM Resorts was targeted by a cyberattack<\/a>, with hackers exfiltrating data such as names, contact information, gender, date of birth, IDs, and even Social Security numbers. The attack reportedly cost the chain around $100 million \u2026 certainly not chump change.<\/p><\/div>

    High rollers have a role<\/h3><\/header>

    So, who\u2019s responsible for the cybersecurity of the casino\u2019s guests? From one point of view, it is the establishment itself, since, as it is providing a service, it needs to cover any liabilities. This is supported by regulations and guidelines recommending tight security, especially for sensitive data. Just off the top, PCI DSS<\/a> would cover payment data, while the NIST Cybersecurity Framework<\/a> would help a casino\/hotel of any size to enact appropriate cyber measures.<\/p>

    For casinos in Las Vegas, the Nevada Gaming Commission (NGC) has a clear set of cybersecurity regulations<\/a> for gaming operators to follow.<\/p>

    Perhaps this also places a bit too much of a burden on these places of entertainment. And, while guests don\u2019t want such thoughts on their minds while hitting the jackpot, the reality is that personal awareness plays a big role when all the chips are down. Otherwise, man-in-the-middle attacks<\/a>, in which cybercriminals create functional, but fake, Wi-Fi access points<\/a> (aka \u201cevil twin\u201d networks), can gather sensitive data from victims\u2019 devices.<\/p>

    Don\u2019t bet the farm!<\/strong><\/p>

    There are threats aplenty in the world of casinos. Scams with fake ads<\/a> copying a well-known casino\u2019s brand can present promising online gambling opportunities with great welcome bonuses. In fact, some of these scams use unauthorized photos<\/a> of employees and properties to appear legitimate. What\u2019s more, by pretending to be casino staff, bad actors could try to social engineer<\/a> their way toward sensitive data, or even gain access to a casino\u2019s systems.<\/p><\/div>

    Ace in the hole<\/h3><\/header>

    What both casino operators and guests have in common is an understanding that stacking the deck in their favor is important. To double down on their security, they should consider:<\/p>