[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [All Bets Are Off on Casinos and Cybersecurity](/blog/all-bets-off-on-casinos-and-cybersecurity) Publish date November 19, 2024 {x} minute read # All Bets Are Off on Casinos and Cybersecurity [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [UpGuard Team](/team/upguard) UpGuard Team Reviewed by Table of contents Free resource ### [Download now](#) You've seen enough Hollywood blockbusters about casino heists to know that gambling institutions are constantly in the crosshairs of attackers—online and off. In the digital realm, however, better [malware](/blog/malware) tools and access to deep funding make today's cyber criminals more than a bad movie, especially when lucrative payloads are for the taking. The Hard Rock Casino has been hit by a series of casino breaches, marking a worrisome trend among [data breach](/blog/data-breach) victims: most targets have suffered one or more similar compromises in the recent past. This pattern of repeated breaches is especially true of retailers and banks, and increasingly—casinos and gaming enterprises.  In May [2015](https://www.reuters.com/article/us-hard-rock-hotel-cybercrime-lasvegas-idUSKBN0NN01G20150502), attackers were able to steal cardholder names, credit card numbers, and CVV codes belonging to hotel guests and customers. In [2016](https://www.csoonline.com/article/3089449/hard-rock-las-vegas-suffers-a-second-data-breach.html) they suffered similar incidents due to malware being installed on POS systems, allowing attackers to steal customers' credit card information.  Investigators hired by the casino discovered unauthorized POS network access and the presence of malware, leading to [this statement](https://www.hardrockhotel.com/statement) issued on June 27, 2016 regarding the second data breach due to malware. However, this time the attack was more widespread than the year before, targeting the resort itself—as opposed to restaurants and retail locations within the hotel. And like other recent attacks, PoS scraping malware was used to steal customer data as it entered the resort’s payment card system. In [2017](https://www.sandiegouniontribune.com/business/economy/sd-me-hard-rock-data-20170707-story.html) still more customer data was exposed through a far-reaching breach of the Sabre booking system.  While Hard Rock itself was not at fault, they still bore the effects of having their name associated with yet another loss of confidentiality regarding customer data. Eleven hotels were affected.  It may come as no surprise that casinos and gaming firms are ideal [cyber attack](/blog/cyber-attack) targets, but how competent are these enterprises when it comes to rudimentary security? Given the volume of privileged financial data collected, you'd expect to see corresponding security measures in place. Let's take a look at some of the top casino/resorts and see if this is the case. ## [Bellagio: 751](https://app.upguard.com/#/https://www.bellagio.com) The Italian-themed Las Vegas hotel/resort and casino scores a solid 751 CSTAR rating. Apparently its fortress-like facade is more than just looks—but a few gaps such as lack of HTTP Strict Transport Security and [DNSSEC](/blog/dnssec) make for a less-than-optimal [security posture](/blog/security-posture). ## [Caesars Palace: 504](https://app.upguard.com/#/https://www.caesars.com) Arguably Las Vegas' most well-known hotel/resort, Caesars Palace—despite its towering facade—has left its digital fortress poorly protected. Lack of DNSSEC and server [data leakage](https://www.upguard.com/blog/data-leak) are a few of its security shortcomings, along with a 53% CEO approval rating, [which increases the risk of internal attack](/blog/why-ceo-approval-matters-for-security-ratings). ## [The Venetian: 561](https://app.upguard.com/#/https://www.venetian.com) This five-diamond luxury hotel/casino may not be the only Italian-themed megaresort on the Las Vegas Strip, but unlike its counterpart the Bellagio, the Venetian lacks various website perimeter security controls—sitewide [SSL](/blog/ssl-certificate), [DMARC](/blog/dmarc), and DNSSEC, to name a few.  ## **Are Online Casinos More Resilient?** Brick-and-mortar gambling establishments are one thing, but what about online casinos born in the cloud? You wouldn't be be blamed for assuming that data-intensive firms like online casinos transacting strictly in the digital domain possess stronger security controls. We can assess their respective security postures and [cyber risk](/blog/cybersecurity-risk) profiles by determining their CSTAR scores. ## [Casino.com: 356](https://app.upguard.com/#/https://casino.com) Despite scoring big with perhaps the most valuable domain name for online gambling, Casino.com receives low marks for a myriad of website perimeter security risks. Lack of sitewide SSL, secure cookies, DMARC, and DNSSEC are a few of its security flaws. ## [Euro Palace: ](https://app.upguard.com/#/https://www.europalace.com)[532](https://app.upguard.com/#/https://www.europalace.com) Leading European online gambling site Euro Palace musters up a decent CSTAR score for sitewide SSL and industry-grade [encryption](/blog/encryption) strength, but falls short due to lack of SPF and DMARC, among others. ## [Ignition Casino: 751](https://app.upguard.com/#/https://casino.betway.com) Online gambling upstart Ignition Casino offers Blackjack, Slots, Poker on its website; fortunately, the company has also taken the requisite security measures for bolstering its [website security](https://www.upguard.com/blog/the-website-security-checklist) and [email security](https://www.upguard.com/blog/email-security). ## Making the World's Largest Banks More Resilient   You read that correctly—many of today's casinos are essentially the world's largest banking operations. But unlike banks, casinos resorts are faced with a myriad of risks introduced by on-site retail establishments, service operations, and countless public-facing ATMs and card readers. The Hard Rock Casino may have fallen victim to sophisticated malware and PoS scraping technologies, but if recent history is any indication, proper patching and [vulnerability](https://www.upguard.com/blog/vulnerability) detection could have saved them from a repeat compromise. This is what UpGuard's resilience platform provides: [validation](/) that your systems are free from security flaws, vulnerabilities, and misconfigurations that could lead to data breaches and outages. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)