The New York State Gaming Commission (NYSGC) says a cyberattack was behind the temporary shutdowns of some casinos in the state. The victim of the attack was Everi Holdings, the company that operates the video lottery terminal (VLT) network on behalf of the state. NYSGC spokesperson Brad Maione said that the incident, which occurred on Oct. 17 and left Jake’s 58 in Long Island closed for three days, remains under investigation.
VLTs operate and look similar to slots, but instead of relying on a random number generator software, they’re linked and operate on the state’s central lottery system. Like lottery scratch-offs, VLTs offer fixed odds.
The NYSGC and Everi have been mostly quiet about the attack, which has left many customers looking for answers. NYSGC says that there’s no evidence that customer information has been compromised. Meanwhile, Everi said it’s analyzing the attack and working with NYSGC to “investigate, contain and remedy the interruption.”
In addition to VLTs, The New York Post reports that two hospitals and a nursing home were also victims of cyberattacks. The Post says that HealthAlliance Hospital and Margaretville Hospital in Hudson Valley had to treat and release or divert patients to other hospitals. It’s unknown if the casino and hospital attacks were related.
Everi Is a Gaming Giant
Everi is a big name in the gaming industry. Aside from VLTs in New York, the company makes many old-school mechanical slots in Las Vegas and nationwide casinos. Everi also makes digital adaptations of these slots, including titles like Cash Machine and Black Diamond. According to its website, the company processed 125 million financial access transactions worth $42 billion in 2022.
While Everi’s been quiet, regulatory requirements might reveal more details. As a publicly traded company, it must report any ransom it may have paid, something that Caesars Entertainment did earlier this year.
Jake’s 58 Says There’s No Indication of a System Breach
The casino that was most significantly impacted by the attack was Jake’s 58 Casino Hotel in Islandia, Long Island. The casino, which has around 1,000 VLTs, was forced to close for three days due to the attack, resulting in an estimated loss of $2 million.
Jake’s 58 insists that there are no indications of a system breach and says that Everi assured them that personal information is safe. Phil Boyle, the president of Suffolk OTB (the parent company of Jake’s 58), said the company is taking the hack very seriously, especially after the recent attacks on MGM Resorts and Caesars Entertainment.
Boyle added that the company will make up the time lost to their customers and ensure that patrons are “protected, safe, and happy.”
While the company assures that no breaches occurred, cybersecurity experts advise players to watch their accounts. According to them, Everi has access to information collected on the VLTs. That means if cyber criminals gained access to Everi’s systems, they could gain personal information from the affected casinos.
The Latest Cyberattack in the Gaming Industry
Everi’s hack marks another attack in the industry this year. In April, 14 Gateway Casinos in Ontario shut down after a cyberattack. MGM Resorts suffered a widespread outage in the US in September. And a regulatory filing revealed that Caesars Entertainment was a victim of an attack in August.
Two hacker groups, Scattered Spider and ALPHV, claimed responsibility for the MGM attack. Experts suggest that the hackers are also behind the Caesars attack, as well as some against companies outside the gambling industry. It’s not clear whether they had anything to do with the attack on Everi.
According to a statement of responsibility, Scattered Spider performed the social engineering while ALPHV supplied the ransomware. The attacks resulted in over a week of disruptions in MGM’s systems and potentially millions in losses. As a result, MGM and Caesars now face multiple class-action lawsuits regarding the compromised customer information.
In these cases, it’s not uncommon for the attackers to go after third-party suppliers rather than the primary target. Just as the Jake 58 attackers exploited a vulnerability at Everi to take the casino down, Caesars said its attackers gained access by using social engineering tactics against an outside IT support contractor.
About the Author
