Missouri's Betting Launch Brings Cybersecurity Concerns for Casinos

Missouri is preparing to launch legal sports betting, marking a significant milestone for casinos entering online wagering for the first time.

However, with the launch upcoming in just days on Dec. 1 comes an increased risk of cybersecurity threats.

Under the framework for Missouri sports betting, casinos may form partnerships with sportsbook operators to offer retail and online betting. However, because real-money online casinos have never been permitted, operators are building digital platforms from the ground up.

Specialists at POWERS Insurance said this shift introduces a period of elevated exposure to cyber threats. According to the firm's specialists, deploying unfamiliar digital infrastructure under these conditions creates a landscape in which early system weaknesses are more likely to be exploited.

They noted that early market stages are especially vulnerable because regulatory processes are still being refined, new vendors are onboarding, and cybersecurity programs may be in early development.

High-profile breaches

The experience of larger operators illustrates how disruptive cyber incidents can be as Missouri casinos step into digital wagering. In September 2023, MGM Resorts International suffered a major cyberattack that disrupted systems across its Las Vegas and regional properties.

The incident was linked to Scattered Spider, an affiliate group of the ALPHV/BlackCat ransomware operation. Rather than relying on complex technical intrusions, the group used social engineering to impersonate an employee and obtain a password reset from the company's help desk.

The attackers were able to move through the network and spread ransomware that shut down casino floors, hotel operations, and online services for almost ten days. MGM refused to pay the ransom, which cost the company about $100 million in lost profits and about $10 million in repair costs. 

The attack also stole customer data from transactions that took place before March 2019.

Smaller operators face similar risks

Smaller businesses are also worried about cybersecurity, as shown by a breach at the OYO-branded hotel-casino in Las Vegas. Court records from an ongoing dispute show that the incident occurred over several days in early January when Highgate Hotels Inc. oversaw the property.

OYO, which owns the site, later accused Highgate of failing to protect its systems and initiated termination proceedings, citing contractual and performance issues.

The breach became public only when separate litigation in New York revealed the incident as part of Highgate's departure from its role as OYO Times Square's manager. In those filings, OYO referenced the Las Vegas intrusion as evidence of inadequate IT safeguards. 

Data filed with the Maine Attorney General's Office indicates that OYO did not issue a formal breach notice until Sept. 18, months after researchers reported that the LockBit 3.0 ransomware group had released roughly 30 gigabytes of company data. 

Paragon Tropicana, part of Paragon Gaming, notified affected individuals on Oct. 9, and the incident entered the public domain on Oct. 14 through reporting tied to the legal dispute.