‘Corporate Terrorism at its Finest’: Cybersecurity for Sports Betting Sites Looms Large in Vegas

“You don’t wish this on anybody," MGM's CEO said at a gaming conference, where cyberattacks are a major topic of conversation.

The recent cyberattacks on the gaming industry are — unsurprisingly — one of the most talked about things at a major gathering of gaming industry execs in Las Vegas, as CEOs and regulators highlight the ongoing effort to protect sports betting sites from hackers.

Nevada-based Caesars Entertainment Inc. and MGM Resorts International were recently the targets of cyberattacks, with the latter saying it expects an approximately $100-million hit to earnings because of the chaos at its hotels and casinos.

“It's corporate terrorism at its finest,” MGM CEO Bill Hornbuckle said Tuesday during a session at the Global Gaming Expo (G2E) in Las Vegas. “You don’t wish this on anybody. It happened to hit us. It was partially socially engineered… and, for a couple of weeks, to our company it was devastating.” 

'There is always a threat'

Hornbuckle said MGM shut down systems on its own to protect customer data during last month’s cyberattack but then had a variety of systems not functioning, which is a problem for a hotel and casino operator. He also said MGM’s rationale for not paying the hackers a ransom was that it had reached a point where the time it would take the company to fix the issue on its own was the same if the hackers handed over the encryption keys.

While MGM has insurance for such incidents, the $100-million or so hit to earnings is substantial, and similar attacks are a concern that all companies in the gaming and legal sports betting sector face. At G2E, the specter of cyberattacks was talked about early and often by executives and regulators, who also took strides to explain what they are doing to combat the threat. 

“The current threat is gone, but there is always a threat,” Hornbuckle said on Tuesday. “So you’ve got to be diligent about it. What we do going forward in terms of architecting the system, how we think about social engineering, and how we think about processes, obviously needs to get better and will be better.” 

No BetMGM spillover

MGM is also a 50-50 owner of BetMGM with Entain PLC, whose CEO, Jette Nygaard-Andersen, spoke at G2E on Tuesday as well. Nygaard-Andersen said they have not seen any impact on BetMGM because of the MGM incident but noted they see themselves as a technology company that is defending itself from intruders daily. 

“We believe in something called defense-in-depth so that we layer our security and our protection,” she told the audience. 

Churchill Downs Inc. CEO Bill Carstanjen said they started seeing attacks on its TwinSpires online business a few years ago. However, he added that the industry is seeing “increasingly effective” social engineering attempts, where hackers try to gain entry to systems through human mistake. 

“The threat has never been greater than now,” Carstanjen said during a G2E session on Tuesday. “And I think there is something to the herd mentality and focus across the industry. So I think all of us in the space are following heightened processes, heightening training processes, more intense focus on everything that goes under the broad category of cybersecurity.” 

Let us know, ASAP

The comments from the CEOs on Tuesday followed several regulatory discussions on Monday about, among other things, the threat of cyberattacks. In Massachusetts, for instance, sportsbook operators must carry cyberattack insurance, like the policy held by MGM. 

While putting regulations in place before such incidents can be helpful, regulators stressed they want to know about what’s going on as soon as possible after, so they can determine how much or how little they should be involved. 

In some instances, the bad actors could be overseas, which may require a response from higher up in law enforcement, or perhaps from Washington. 

“I think from our perspective we want to be notified as soon as they possibly can tell us and provide as much information as can be shared,” Illinois Gaming Board Administrator Marcus Fruchter said during a G2E panel on Monday. “And then we also want to make sure that they have a plan to address what's happening.”