Casinos run cash, regulated gaming systems, surveillance, hotels and loyalty programmes on one estate, and attackers have shown that a single help desk call or a gaming vendor's remote connection can take all of it offline. Gaming regulators have responded with specific cyber rules: Nevada now requires notice within 24 hours of activating incident response, and the UK Gambling Commission requires annual independent security audits of remote operators against ISO/IEC 27001:2022 controls. This guide covers the casino threat picture, the gaming, anti-money laundering and tribal gaming rules that carry security obligations, and the controls that differ from a general enterprise. It is for security and compliance leads at commercial and tribal casinos, integrated resorts, online gambling operators and gaming suppliers. Hotel operations common to resorts are covered in the Cybersecurity for Hospitality Guide.
Key takeaways
- Gaming regulators now set cyber deadlines. Nevada Regulation 5.260, amended on 29 January 2026, requires notice to the Chair within 24 hours of activating the incident response plan and a written initial report within five calendar days.
- Identity takeover is the proven attack path. The 2023 MGM Resorts and Caesars Entertainment incidents both began with social engineering of a help desk or IT support vendor, not a software exploit.
- Gaming vendors are a ransomware route. The FBI reported ransomware attacks on casinos, often small and tribal ones, through third-party gaming vendors and vendor-controlled remote access.
- Player data is unusually sensitive. Loyalty and player tracking systems hold identity numbers collected for anti-money laundering and tax rules, alongside gambling behaviour.
- Recovery must cover the casino floor. Slot systems, cage, surveillance and door access are all IT systems under tribal minimum internal control standards, and all need tested backups and a manual fallback.
What makes casino security different
- Regulated gaming systems: slot management, casino management, table games, sports betting and random number generator platforms are licensed or approved systems. Change control is regulator-facing, so patching and configuration changes need gaming compliance sign-off.
- Cash and AML obligations: US casinos are financial institutions under the Bank Secrecy Act. Under 31 CFR Part 1021 they must run an AML programme (1021.210), file currency transaction reports for cash transactions of more than $10,000 in a gaming day (1021.311 and 1021.313) and file suspicious activity reports at a $5,000 threshold within 30 calendar days of detection (1021.320). The systems that hold this data are high-value targets and must stay accurate.
- Surveillance and physical security on the network: the NIGC definition of a gaming "system" in 25 CFR 543.20 includes surveillance, phone and door access systems as well as servers and accounting.
- Integrated resorts: hotel, food and beverage, retail, entertainment and gaming share an identity provider and virtual infrastructure. An outage of either stops all of them.
- Online and omnichannel gaming: internet gaming, mobile sports betting and cashless wallets add customer account takeover, bonus abuse and payment fraud to the on-property risks.
Threat picture
| Threat | Casino example | ATT&CK v20 | Primary control |
|---|---|---|---|
| Help desk social engineering | Caller impersonates an employee found on LinkedIn to reset credentials, leading to identity provider admin | T1566.004 Spearphishing Voice, T1078 Valid Accounts | Caller verification, phishing-resistant MFA |
| Support vendor compromise | Outsourced IT support persuaded to act for the attacker | T1199 Trusted Relationship | Vendor reset limits, privileged accounts out of vendor reach |
| Gaming vendor remote access | Ransomware delivered through a gaming supplier's remote connection to casino servers | T1199 Trusted Relationship, T1219 Remote Access Tools | Brokered, recorded, time-bound vendor access |
| MFA fatigue and attacker MFA enrolment | Push prompts accepted, attacker registers own token for persistence | T1621, T1556.006 | FIDO2 for admins, alert on MFA changes |
| Hypervisor ransomware | ESXi hosts encrypted, taking casino management, hotel and email offline | T1486 Data Encrypted for Impact | Isolated hypervisor management, immutable backups |
| Player data theft and extortion | Loyalty database copied, ransom demanded for deletion | T1567.002 Exfiltration to Cloud Storage, T1657 Financial Theft | Database activity monitoring, egress controls |
| Online account takeover | Credential stuffing against player accounts to withdraw balances | T1078 Valid Accounts | Customer MFA, bot management, withdrawal step-up |
The FBI Private Industry Notification of 7 November 2023 (20231107-001) reported that between 2022 and 2023 ransomware actors attacked casinos through third-party gaming vendors, often hitting small and tribal casinos and encrypting servers and the personal data of employees and patrons, and flagged vendor-controlled remote access to casino servers as a new trend. The FBI and CISA Scattered Spider advisory (AA23-320A) lists commercial facilities, which include the gaming subsector, among the targets. See the Scattered Spider Threat Actor Profile and the ALPHV BlackCat Threat Actor Profile.
Regulation by jurisdiction
Requirements are summarised from the regulators' own texts as of October 2026. Gaming rules change by regulation amendment and technical standard update, so check the current text before relying on any timeframe.
| Regime | Who it covers | Security obligations |
|---|---|---|
| Nevada Gaming Commission Regulation 5.260 (amended and effective 29 January 2026) | Nonrestricted licensees operating games, race books, sports pools and interactive gaming licensees | Risk assessment and best practices within 90 days of licensing, using frameworks such as CIS Controls v8, COBIT 5, ISO/IEC 27001 or NIST SP 800-53; documented incident response plan; notify the Chair within 24 hours of activating response procedures; initial incident response report within 5 calendar days (or a meeting request, with the report then due within 30 days); written updates every 30 days; root cause investigation; Group I licensees designate a qualified individual and obtain an annual internal audit and an annual independent review with written attestation; records kept 5 years |
| UK Gambling Commission Remote Gambling and Software Technical Standards (RTS) security requirements | Remote operating licence holders, including remote casino, betting and bingo, and larger lotteries | Controls drawn from ISO/IEC 27001:2022 Annex A applied to critical systems (sensitive customer data, random number generation, game results and state, their entry and exit points, and networks carrying customer data); first independent security audit within 6 months of licensing, then annually; auditor independent and qualified against ISO/IEC 27001:2022; suppliers with access to critical systems in scope; major non-conformities reported without delay |
| NIGC Minimum Internal Control Standards, 25 CFR 543.20 | Class II tribal gaming operations, with tribal gaming regulatory authority (TGRA) approval of periods | Restricted physical access to IT; logging; unique user credentials; deactivation of terminated users within a TGRA-approved period; each remote support session documented (who authorised, who accessed, reason, work, times) over a secured method; incident procedures; daily backups of critical systems and at least annual sample recovery testing |
| Bank Secrecy Act, 31 CFR Part 1021 | US casinos and card clubs | AML programme with internal controls, independent testing, training and automated compliance programs where data processing systems are used; SAR records kept 5 years |
| PCI DSS v4.0.1 | Any operator accepting cards at hotel, retail, F&B or online | Standard cardholder data obligations; see the PCI DSS 4.0 Guide |
Nevada's 2026 amendments replaced "cyber attack" with "cybersecurity incident" and, per the Board's Notice 2026-33, include incidents at third-party vendors where patron personally identifiable information was compromised. That makes vendor contracts that require prompt notification to the licensee a compliance need, not just good practice. Other US states and tribal regulators set their own technical standards; this guide does not cover them individually.
Priority controls for casinos
Identity and help desk
- Verification script: resets of passwords or MFA require a callback to a number on file, manager approval or an in-person check at security; nothing an attacker can learn from social media counts. Apply the same rules to outsourced desks by contract. See the Account Recovery and Help Desk Security Guide.
- Admin authentication: FIDO2 security keys for identity provider, hypervisor, casino management system and cloud admins, as AA23-320A recommends. See the Phishing-Resistant MFA Guide.
- Identity provider hardening: separate admin accounts, just-in-time elevation, a second approver for admin and federation changes, and alerts on MFA resets. See the Okta Security Hardening Guide.
Gaming vendors and remote access
- One gateway: slot, casino management, surveillance and kiosk vendors connect only through a brokered gateway with MFA, approval per session and recording, which also produces the session records 25 CFR 543.20(h) requires for tribal operations.
- No unmanaged remote tools: allowlist approved remote support software and block the rest, as both the FBI notification and AA23-320A recommend. See the RMM Tool Security Guide and the Application Allowlisting Guide.
- Contract clauses: incident notification to the licensee fast enough to meet the 24-hour Nevada clock, right to audit, named accounts, and MFA. See the Third-Party Risk Management Guide.
Network and floor systems
- Segmentation: separate gaming floor systems, cage and count, surveillance, hotel, corporate, guest Wi-Fi and payment networks; corporate users should have no path to slot or surveillance networks. See the Network Segmentation Guide.
- Hypervisors: manage ESXi from a dedicated admin network, not joined to the corporate domain, with lockdown mode where supported. See the Hypervisor and Virtualisation Security Guide.
- Building and IoT devices: door access, environmental sensors and digital signage on their own segments with vendor defaults removed. See the IoT Security Guide.
Player data and online gaming
- Minimise identity numbers: keep Social Security, driver's licence and passport numbers in restricted, encrypted fields accessible only to compliance roles, not to the whole marketing database.
- Online accounts: MFA for players, step-up on withdrawals and payment method changes, and bot defences against credential stuffing. See the Password Spraying and Credential Stuffing Defence Guide.
Where non-human identities fit
Casino estates depend on machine credentials: directory sync servers, casino management system interfaces to loyalty and hotel systems, sports betting data feeds, payment gateway keys, and service accounts that vendors use. MGM shut down its Okta sync servers during the 2023 incident. Give each service account an owner, scope it to the integration it serves, rotate it when vendors change staff, and monitor for interactive logons by service accounts. See the Privileged Access Management Guide.
Implementation roadmap
- First 30 days: map every regulator and the deadlines each sets; write the 24-hour notification and 5-day report into the incident response plan with named owners; list all vendors with remote access and all identity provider and hypervisor admins.
- Days 30 to 90: deploy the help desk verification script (pilot one desk, then all, including outsourced); enforce FIDO2 for admin roles after a report-only period, with monitored break-glass accounts; move vendor access behind the gateway one vendor at a time, with a fallback path agreed with gaming compliance.
- Months 3 to 6: segment floor, surveillance, cage and hotel networks; isolate hypervisor management; enforce remote tool allowlisting after two weeks in audit mode.
- Months 6 to 12: immutable, offline backups of casino management, loyalty and AML data with a recovery test documented to the standard 543.20(j) expects; run a tabletop where identity and hypervisors are lost on a peak weekend, including regulator notification and manual floor operations.
- Rollback and change control: every enforcement change to gaming systems goes through gaming compliance approval with a documented reversal, because an unapproved change to a regulated system is its own finding.
Small versus large: a single tribal or regional casino with a small IT team should prioritise vendor remote access control, offline backups and an MSP bound to help desk and access standards, and can use the TGRA-approved MICS as its baseline. A multi-property operator needs central identity with phishing-resistant admin MFA, a dedicated security operations capability with gaming system visibility, and a Group I-style audit cycle even where not required.
Detection and measurement
- Identity: MFA resets followed by new devices, new authenticator registrations, new identity provider admins or federation changes.
- Vendor sessions: sessions outside approved windows, from unknown sources or touching systems outside the vendor's scope.
- Infrastructure: SSH enabled on ESXi hosts, mass virtual machine shutdowns, new remote tools executing.
- Data: bulk queries against loyalty and player tracking databases, large outbound transfers.
| Metric | Target direction |
|---|---|
| Admin accounts on phishing-resistant MFA | 100 percent |
| Vendor sessions brokered, approved and recorded | 100 percent |
| Time from incident declaration to regulator notification in exercises | Under 24 hours |
| Critical gaming and AML systems with a successful restore test in the last 12 months | 100 percent |
| Open findings from the annual independent review or security audit | Falling, none overdue |
| Help desk resets with full verification (sampled) | 100 percent of sample |
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Authentication and help desk | PR.AA-01 | IA-2(1), IA-5 | 6 | 5.17, 8.5 |
| Privileged and admin access | PR.AA-05 | AC-6, AC-2 | 5, 6 | 8.2 |
| Gaming vendor access | GV.SC-07, GV.SC-05 | AC-17, SR-6 | 15 | 5.19, 5.20 |
| Remote tool allowlisting | PR.PS-05 | CM-7(5) | 2 | 8.19 |
| Network segmentation and monitoring | DE.CM-01 | SC-7, AU-6 | 12, 13 | 8.16, 8.22 |
| Backup and recovery | RC.RP-01 | CP-9 | 11 | 8.13 |
| Regulator and incident reporting | RS.MA-01 | IR-6 | 17 | 5.24, 5.26 |
Common failure patterns
- Help desk resets on public information. In the MGM Resorts breach the attackers said they called the IT help desk posing as an employee found on LinkedIn; they claimed Okta and Azure admin access, ALPHV said it encrypted more than 100 ESXi hypervisors, and MGM estimated a $100 million impact.
- Outsourced support treated as trusted. The Caesars Entertainment breach began with social engineering of an outsourced IT support vendor and ended with the loyalty database, including driver's licence and Social Security numbers, copied.
- Always-on gaming vendor connections. The FBI's 2023 notification describes ransomware arriving through vendor-controlled remote access to casino servers.
- Corporate domain admins managing hypervisors. Once the identity provider falls, every virtualised gaming and hotel system falls with it.
- Incident plans without the regulator clock. A plan that does not name who notifies the Nevada Chair, or the UK Gambling Commission for major non-conformities, will miss deadlines in the first chaotic day.
- Identity numbers spread across marketing systems. AML and tax data copied into loyalty and CRM tools multiplies the exposure of any breach.
Lessons from incidents
The two September 2023 Las Vegas incidents took different paths after the same start. MGM did not pay and was disrupted for about ten days across casinos, reservations, email and digital room keys. Caesars disclosed in an SEC 8-K that it had taken steps to have stolen data deleted, and the Wall Street Journal reported a payment of about $15 million, which Caesars did not explicitly confirm. Neither outcome was cheap. The shared lesson is that the identity provider is the casino's most critical system, and the help desk is its front door. Nevada's 2026 amendments, with their 24-hour clock and vendor incident coverage, follow directly from that experience. See the Ransomware Response and Recovery Guide and the Ransomware Payments and Sanctions Guide.
Practitioner checklist
- Record every gaming, AML and data protection regulator that applies, with each notification deadline and its owner.
- Add the Nevada 24-hour notice and 5-day initial report (or equivalent) to the incident response plan and test them in a tabletop.
- Enforce a help desk verification procedure on internal and outsourced desks.
- Require FIDO2 for identity provider, hypervisor and casino management system administrators.
- Route all gaming vendor access through a brokered, recorded gateway and block unapproved remote tools.
- Segment floor, surveillance, cage, hotel, corporate and guest networks.
- Isolate hypervisor management from the corporate domain.
- Keep immutable offline backups of casino management, loyalty and AML systems and test restores at least annually.
- Restrict identity document numbers to compliance roles and encrypt them at rest.
- Prepare evidence for the annual independent review or security audit continuously, not once a year.
Standards and references
- Nevada Gaming Commission: Regulation 5.260 Cybersecurity
- Nevada Gaming Control Board: Industry Notice 2026-33
- UK Gambling Commission: RTS Security Requirements
- UK Gambling Commission: Security Audit Advice
- US Code of Federal Regulations: 25 CFR 543.20 Information Technology
- US Code of Federal Regulations: 31 CFR Part 1021 Casinos and Card Clubs
- FBI: Ransomware Actors Continue to Gain Access through Third Parties and Legitimate System Tools
- CISA and FBI: Scattered Spider Advisory AA23-320A
Related NHI Mgmt Group resources: Cybersecurity for Hospitality Guide · ESXi Ransomware Playbook · Third-Party Access Guide · Identity Provider and SSO Security Guide. This guide summarises gaming, anti-money laundering and data protection requirements and is not legal advice.