Infamous Casino Data Breaches

July 7, 2022 at 6:13 pm by Amanda Canale

While many industries were negatively impacted by the 2019 coronavirus pandemic, one industry not only survived, but thrived: the commercial gambling industry. The casino and commercial gambling industry made approximately $44 billion in 2021, shattering their previous 2019 record. Given this major spike, experts are predicting that the gambling industry will become a neon target for future thieves and cyberattacks.

In our previous blog, Just How Secure Are Casinos?, we broke down the varying security measures casinos take in the form of RFID software located in playing chips, license plate recognition, and other advanced software to ensure that no stealing or cheating occurs. Fortunately, this advanced technology allows the casinos to remotely render chips and other materials worthless if someone were to steal them and allows personnel to have eyes on gamblers at all times.

However, unfortunately, these measures do not completely prevent casinos from being hacked. We’ve broken down a few of the more infamous casino data breachers below and included best practices to ensure that your data stays protected.

Clubillion

In summer 2020, the gambling app, Clubillion, found that their database had been “leaking data” from millions of the app’s customers. The app was contacted on March 23, 2020 but the database was not secured until April 5, 2020. What makes this data breach different than other similar data breaches is that the database was updated with up to 50GB (or 200 million records) worth of information daily. These records logged every player’s actions, their personally identifiable information (PII), private messages, and even IP addresses.

A rep from Clubillion stated that, “on a single day, tens of thousands of individual Clubillion players were exposed.” In addition to a loss in reputation and customers, the popular gabling app may be subjected to other scrutiny and fines from GDPR regulators and GooglePlay and app stores.

Slot Machine One Handed Bandit Game. Rolling Drums. Casinos and Gambling Industry.

Federal Group

In April 2021, Tasmanian casino operator, Federal Group, found themselves in the midst of a cyberattack after their pokies machines (otherwise known as slot machines) and hotel booking systems began to malfunction. At the time of the breach, the casino group was unsure if credit card details stored in the hotel booking system were also compromised and have yet to publicly release that information.

International privacy and security consultant, Terry Aulich, stated that he was “extremely disappointed” with the business’ cyber defenses and warned other Tasmanian organizations to learn from Federal Group’s mistakes. Between Federal Group’s two casinos, patrons had spent upwards of $53.7 million on pokies in the eight months leading up to the breach. 

MGM Resorts International

MGM Resorts International became the victims of a data breach in summer 2019, but it was not made public until February 2020 after a third party published an article detailing the breach. The breach had compromised the records of over 10.6 million guests dating back from 2017. The cyberattackers were able to hack into the resort’s cloud server and then was posted to a public hacking forum. 

Guest PII such as full name, home and email addresses, phone numbers, and birthdates had all been breached, but luckily did not include financial or payment card information. The breach wasn’t also just limited to guests; victims ranged from tourists and travelers, to media reporters and journalists, to company executives and employees. 

At SEM, we offer secure, in-house destruction. With our low and high volume disintegrator solutions, casino materials and solid state boards can be easily destroyed to a predetermined and consistent particle size. As we know, casinos house a lot of sensitive information regarding personnel, patrons, financial information, and advanced technology that should be secured, even in end-of-life. 

Depending on the needs of the casino, SEM has every device necessary to properly and efficiently disintegrate chips as intended since our inception in 1967. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.

For more information on our casino solutions, visit our website here

Just How Secure Are Casinos?

June 10, 2022 at 4:46 pm by Amanda Canale

Even in the midst of a worldwide pandemic, the commercial gambling and casino industry made approximately $44 billion in 2021, surpassing the previous record set in 2019. According to the American Gaming Association (AGA), in-person slots and table games are leading the industry’s recent growth. Given the exponential growth, and (quite literally) billions of dollars on the line, experts predict that the casino industry will be a flaming red target for hackers and thieves.

You’re probably thinking, “what information is even stored on casino chips, playing cards, and dice?” Frankly, quite a lot.

Even more so, casino chips are not the only items that are loaded with information; the same goes for playing cards, dice, and personnel access cards. In this blog, we break down the varying security measures casinos take and how a proper destruction plan your casino can better protect your assets.


Radio-Frequency Identification (RFID)

Casino chips may seem like a cheap piece of plastic, but what many do not know is that these seemingly simple items carry loads of information and are packed with advanced technology. These chips are embedded with radio-frequency identification (RFID), which is used to track them and broadcast unique serial identifiers over radio frequencies. RFID technology identifies and tracks every chip for authenticity, tracking history, and to ensure there is no forgery, cheating, or stealing. Additionally, each casino carries uniquely branded chips, including color combinations, marked edges, and UV markings that are impossible to recreate. The RFID-reading technology also detects when counterfeit chips are being used. 

While you cannot “hack into” casino chips, it’s still possible for people to steal them for money, especially since they are a form of currency within casinos. For example, in 2010, a man stole $1.5 million in chips from the Las Vegas Bellagio casino. However, due to the RFID technology within the chips, authorities were able to remotely render the chips worthless by turning off the chips’ transmitters before the robber could turn them in for cash.

casino chips

License Plate Recognition

Like many secure facilities, casinos have security measures in place tracking you before you even have the chance to park your car. Once your car enters the camera’s frame, the license plate recognition technology scans your plates and converts them into text, which is then compared against the casino’s database. What are they looking for exactly? The software runs your license plate against their records to see if you are a known gambling addict, thief, or on their internal blacklist. This process is to ensure that no undesirable patrons are allowed into the facility.

Angel Eye

Like I stated earlier in this blog, chips are not the only casino materials that are loaded with information. Playing cards carry invisible bar codes that help sensors and security software, such as Angel Eye, track their movement, which ones are being dealt, and to prevent card-switching. The software was specifically designed to prevent card switching, which is prominent in other parts of the world.

When a dealer deals cards, the software tracks the dealt cards through a sensor in the dealing shoe (the container that houses the cards). After this first scan and once the cards are revealed on the table, the dealer presses a hidden button that scans the table and upward facing cards a second time. The Angel Eye software compares them to the initial scan to ensure that the results on the table matches what the computer says. 

TableEye21

TableEye21 is a powerhouse of a security device; it is made up of varying technologies all wrapped into one concise solution. It includes an overhead video camera that tracks the table’s actions and players, includes video analysis software and information sent by the RFID chips, and overlays the video feed with real-time data tracking on cards and chips being used. 

TableEye21 tracks every action on the table, including dealer rounds per hour, trend reports, and the player win percentage. Casino authorities use this information to identify if a player is counting cards, using counterfeit chips and cards, or scheming with the dealer in order to win. 

NORA

NORA stands for Non-Obvious Relationship Awareness software, and it goes hand in hand with all of the security measures we discussed above. Whether a dealer notices something off about a player or the TableEye21 software picks up on odd numerical trends, NORA can be used to scan the casino’s databases for information and recognize relationships between players and dealers alike.

What relationships, you ask? Let me give you an example.

If casino personnel put Brian Jones into NORA, the software will scan all of the casino’s databases and be able to see that Mr. Jones, who applied for a dealer position, is actually Paul Johnson, a notorious poker scammer. In addition, it can connect people entered into NORA based on their similar backgrounds. So once NORA finds out that Brian Jones is really Paul Johnson, it also connects Paul to another player, Zachary Jost. From there, the software connects the dots and finds out that Paul and Zachary were fraternity brothers during their undergrad career and that they were both arrested for the same fraud case.

Another potential outcome is NORA discovering that the dealer and a player used to share the same address and phone number, possibly meaning that they are in on a scam together.

If that wasn’t impressive enough, we should probably mention that it was after 9/11 that the Department of Homeland Security began using the advanced software to help identify relationship links between potential terrorists and criminals. 

This is not an exhaustive list by any means; there are many other security measures and advanced tracking technology that casinos use in order to maintain order and ensure honest playing. However, there is one more security method we’d like to discuss: the destruction of casino materials.

dice-shredding

As of this writing, there are no federal laws concerning data protection that casinos have to abide by. However, casinos and gaming facilities are required to abide by their state’s safeguarding mandates and financial privacy regulations. In order to maintain the stringent policies set in place to prevent fraud and criminal activity, it is crucial for casinos to establish further security measures for the destruction and disposal of these technology-ridden materials. 

In the past, casinos have thrown their chips and cards out with the trash, some even building them into the foundations of casinos out of superstition. But in recent years, casinos have been required to destroy their chips and cards according to predetermined expiration dates. Typically, the expired materials are sent out to a third party destruction facility where they are often dumped into landfills or left vulnerable to thievery by the third party vendors.

At SEM, we offer a better alternative: secure, in-house destruction. With our low and high volume disintegrator solutions, dice, chips, and playing cards can be easily destroyed to a predetermined and consistent particle size. As we know, casinos house a lot of sensitive information regarding personnel, patrons, financial information, and advanced technology that should be secured, even in end-of-life. 

One solution is the SEM Model DS-400, a dual stage turnkey disintegrator that has been evaluated by NSA and meets the requirements of NSA/CSS specification for Paper Disintegrators, CDs, and Key Tape. This compact and portable device is perfect for the destruction of paper, optical media, key tape, casino chips, metal and plastic cards, and more.

Need something with a higher volume? We suggest a SEM VKE Disintegrator system. Our VKE (value kit enclosure) disintegrator systems include your choice of disintegrator, air system, state-of-the-art technologies and features like a customized MX sound enclosure to reduce sound and dust during operation, a solid steel rotor designed to provide 70% more rotor mass than open rotor designs, and user-friendly master control panel.

Depending on the needs of the casino, SEM has every device necessary to properly and efficiently disintegrate chips as intended since our inception in 1967. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.

For more information on our casino solutions, visit our website here.