Most casino data breaches do not begin with a brilliant piece of hacking. They begin with a password reused from another site, a phone call to a help desk that nobody verified, or a database an operator forgot was reachable from the open internet. Reviewing the gambling industry’s best-documented incidents — MGM Resorts, DraftKings, Germany’s Merkur Group, and a string of unsecured Elasticsearch and MongoDB instances tied to offshore operators — shows a narrow set of recurring failures: weak identity verification, missing encryption hygiene, and vendors with looser controls than the casino itself. Weaker sites are not unluckier; they are simply missing the specific controls that would have stopped each of these attacks.
Key takeaways
- Social engineering, not malware, opened the door at MGM Resorts. A vished phone call to an IT help desk gave attackers administrative access to identity systems, preceding a ransomware event MGM estimated cost it roughly $100 million in lost EBITDAR.
- Password reuse drove the DraftKings incident. DraftKings said the login credentials used against its platform were stolen elsewhere and matched to accounts where customers had reused the same password, exposing personal data on nearly 68,000 accounts.
- Misconfiguration, not a targeted attack, exposed 800,000+ Merkur Group players in 2025, including IBANs, card details and full game-session logs, after a researcher found backend APIs left open.
- Breach costs in hospitality-adjacent sectors are rising, with IBM’s 2025 global research putting the average breach cost at $4.44 million and the hospitality sector at $4.03 million.
- UK licence conditions require fast disclosure. Operators must report any information-security breach that affects the confidentiality of customer data, and failure to comply can trigger licence suspension or revocation.
Table of contents
How casino breaches actually start
Industry-wide breach research consistently points to a small number of entry methods, and gambling incidents follow the same pattern. Verizon’s 2025 Data Breach Investigations Report, built from more than 12,000 confirmed breaches, found that stolen credentials remained the leading initial access vector, used in 22% of breaches, with phishing around 15%. Third-party involvement in breaches doubled year over year, rising from 15% to 30% of all breaches, and the human element was present in roughly six in ten incidents.
Casino-specific cases map directly onto those categories:
- Credential stuffing. Attackers take username/password pairs leaked from unrelated breaches and test them automatically against a casino’s login page, banking on password reuse. This is what hit DraftKings in November 2022.
- Social engineering against staff, not players. A convincing phone call to an IT help desk can bypass technical controls entirely, as it did at MGM Resorts.
- Exposed databases. Backend systems — often ElasticSearch or MongoDB instances used for analytics or player tracking — are sometimes left reachable without a password, a configuration error rather than an “attack” in the traditional sense.
- Vendor and payment-integration risk. Casinos route funds through third-party cashiers, KYC providers and payment processors; a flaw in any one of those integrations can expose data the casino itself never directly mishandled. We cover how this is tested in our payment gateway audit methodology.
Weak transport-layer security compounds all four. A site still serving outdated TLS configurations or mixed content gives credential-stuffing bots and session hijackers an easier path once they have a foothold — a gap we test for directly, described in how we test casino SSL and server-side encryption.
Four breaches that show the pattern
The table below summarizes publicly confirmed or regulator-acknowledged incidents involving real-money gambling platforms, ordered by the primary attack vector rather than severity.
| Operator / network | Year | Primary vector | Data exposed | Scale |
|---|---|---|---|---|
| MGM Resorts (incl. BetMGM-adjacent systems) | 2023 | Vishing call to IT help desk, followed by ransomware | Name, contact details, gender, date of birth, driver’s license numbers; Social Security and passport numbers for some customers | Scope spanned systems across U.S. properties; a related class action references up to 200 million guest records |
| DraftKings | 2022 | Credential stuffing (password reuse) | Names, addresses, phone numbers, emails, profile pictures; account funds | 67,995 customer accounts confirmed affected; up to $300,000 withdrawn |
| Merkur Group casino platforms | 2025 | Misconfigured backend APIs | Names, player IDs, IBANs, card details, full session/bet logs | Over 800,000 player records across multiple sites |
| Mountberg-linked casino network (azur-casino.com and others) | 2019 | Unsecured ElasticSearch database | Names, addresses, partial card numbers, balances, deposit/withdrawal history | 108 million betting records |
| Fixbet (unlicensed operator) | 2023 | Exposed MongoDB instance, attributed to human error | User account details, server and SMB logs, email logs | 850,000 users |
In the MGM case, attackers breached MGM’s network using social engineering, stole sensitive data, and encrypted over a hundred ESXi hypervisors, disrupting slot machines, hotel key systems and reservations for days. MGM’s own 10-K filing is specific about what was taken: name, contact information, gender, date of birth and driver’s license numbers for many customers, with Social Security and passport numbers obtained for a limited number. The company has since confirmed the financial hit at roughly $100 million in lost EBITDAR for the quarter.
DraftKings presents a cleaner case of a weak-link failure outside the operator’s own perimeter. The company said its systems were not breached but that the login information of the impacted customers was stolen elsewhere and applied to their DraftKings accounts, where the same passwords were reused. Once inside, attackers moved fast: criminals rapidly changed the 2FA settings by redirecting to another phone number, locking out the actual owners of the accounts. That detail is exactly why we treat two-factor authentication as a scored criterion rather than a checkbox feature — see the 2FA mandate for how a hijackable second factor can be worse than none.
The Merkur Group case is the most recent large-scale example of pure misconfiguration. A researcher found that Merkur’s casino backend exposed full names, account usernames and internal player IDs, detailed game session logs including IP addresses and device details, and extensive financial records, with transactions through at least seven payment providers exposed, including roughly 104,000 IBAN records via Trustly and 128,965 card-detail records via Adyen. No credential stuffing or social engineering was required — the data was simply reachable.
What attackers do with stolen casino data
Casino account data is monetized differently depending on what was taken. Account credentials with linked balances are the most immediately liquid: in the DraftKings incident, stolen or validated DraftKings logins were sold on the dark web for $10 to $35, complete with instructions on withdrawing linked bank funds. Identity data — date of birth, driver’s license or passport numbers, the categories MGM confirmed were exposed — has a longer shelf life and feeds into synthetic identity fraud and account-opening scams well after the headlines fade.
A third category applies specifically to unlicensed or “underground” operators. When researchers found an exposed database belonging to Fixbet, a Tor-accessible casino aimed at a market where gambling is largely prohibited, they noted that attackers could resort to blackmailing the casino’s users, since the users themselves were engaging in activity illegal in their jurisdiction. That risk simply does not exist at a properly licensed operator, which is one reason jurisdiction and licence tier are weighted so heavily in our scoring.
Centralized, server-side player databases are also what make a single breach so damaging — one misconfigured instance can expose years of betting history at once. It’s a structural weakness we examine directly in blockchain ledgers vs. traditional servers, since the two architectures fail in very different ways.
Why weak licensing and offshore hosting raise the risk
The 2019 Elasticsearch leak is instructive because of who owned the data, not just its size. Researchers traced the exposed records of more than 108 million bets to a Curaçao-licensed operator, with players’ real names, home and email addresses, phone numbers, birth dates and account balances all exposed. Many of the affected brands operated under a single Cyprus-based parent, a company called Mountberg, running multiple consumer-facing skins off shared, apparently under-secured back-end infrastructure — a common cost-saving pattern among lower-tier licensees.
Regulatory regimes diverge sharply on how they respond to this kind of failure. Under the UK Gambling Commission’s licence conditions, operators are obligated to report any breach in the licensee’s information security that adversely affects the confidentiality of customer data or prevents customers from accessing their accounts for longer than 24 hours, and the Commission has stated plainly that a financial penalty can be imposed wherever it thinks a licence condition has been breached. An offshore or loosely regulated licence typically carries no equivalent disclosure obligation at all, which means a breach at a weak site may never be formally reported, let alone remediated under regulatory pressure.
The regulatory and financial fallout
Breach costs have become a standard line item for large operators. IBM’s 2025 Cost of a Data Breach Report, drawn from 600 breached organizations, put the global average breach cost at $4.44 million, with the hospitality sector averaging $4.03 million — a category that overlaps significantly with casino and resort operators. MGM’s own disclosures put a harder number on a single incident: the company’s 8-K estimated a negative impact of approximately $100 million to Adjusted Property EBITDAR for the quarter, on top of ensuing class-action litigation and a settlement fund that later compensated guests at tiered amounts depending on data sensitivity.
UK enforcement data shows the broader pattern of what happens once a regulator starts reviewing an operator’s controls, even when the initial trigger isn’t a breach. Recent Gambling Commission actions include a £2,022,000 fine against Spreadex, a £1 million fine against ProgressPlay, and a £10 million penalty against Platinum Gaming, the operator behind two well-known consumer brands, following a licence review that also required an independent third-party audit. These cases were primarily anti-money-laundering and social-responsibility failings rather than data breaches, but they illustrate the same underlying point: once a regulator opens a licence review, it tends to surface every control gap at once, information security included.
Third-party exposure is rising across the board, not falling. Verizon’s analysis found that breaches involving external partners doubled year over year, now accounting for 30% of all breaches, which is exactly the dynamic behind the Merkur payment-provider exposure. A casino can harden its own servers and still be compromised through a KYC vendor, affiliate tracker, or payment gateway it doesn’t fully control — the specific risk our payment gateway audits are designed to flag.
Frequently asked questions
What’s the single most common cause of a casino account getting hacked?
Based on confirmed incidents, credential stuffing driven by password reuse is the most common cause of individual account takeovers, as seen in the DraftKings case, where the login information of impacted customers was stolen elsewhere and applied to their DraftKings accounts. Using a unique password per site and enabling 2FA defeats this method almost entirely.
Does holding a gambling license mean a casino can’t be breached?
No. A license mainly affects what happens after a breach: tier-one regulators like the UK Gambling Commission require rapid disclosure of confidentiality incidents and can suspend or fine a licensee for inadequate controls, while offshore licensees often carry no equivalent reporting duty, so weak security can go unaddressed for years.
What player data is most valuable to attackers?
Linked payment credentials and active account balances are the most immediately cashable, as shown by the dark-web resale of compromised DraftKings logins. Government ID numbers, dates of birth and addresses — the data MGM confirmed was taken — are less liquid but more durable, feeding long-term identity fraud.
How can a player reduce their own exposure on a weak site?
Use a password manager so no casino login is reused elsewhere, enable 2FA through an authenticator app rather than SMS where possible, and unlink stored bank details when not actively withdrawing. These steps neutralize the exact method used against DraftKings customers in 2022.
Methodology
For this category, our algorithm cross-references an operator’s licence tier and jurisdiction against public breach-disclosure records, regulator enforcement notices, and the presence or absence of mandatory 2FA and current TLS configurations captured during scraping. These signals feed into the security sub-score described in our security, fraud detection and fair play hub and are weighted alongside other factors under the scoring system and algorithmic weights. No operator pays for inclusion or placement in this analysis.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
